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FOREWORD 


The Space Shuttle Phase B studies are directed toward the definition 
of an economical space transportation system. I-n addition to the missions 
which can be satisfied with the shuttle payload capability, the National 
Aeronautics and Space Administration has missions planned that require 
space vehicles to place payloads in excess of 100, 000 pounds in earth orbit. 
To satisfy this requirement, a cost-effective multimission space shuttle 
system with large lift capability is needed. Such a system would utilize a 
reusable shuttle booster and an expendable second stage. The expendable 
second stage would be complementary to the space shuttle system and impose 
minimum impact on the reusable booster. 

To evaluate the expendable second stage concept, a two-phase study 
was authorized by NASA. Phase A efforts, which ended in December 1970, 
concentrated on performance, configuration, and basic aerodynamic con- 
siderations. Basic trade studies were carried out on a relatively large 
number of configurations. At the conclusion of Phase A, the contractor 
proposed a single configuration. Phase B commenced on 1 February 1971, 
based on the recommended system. Whereas a large number of payload 
configurations were considered in the initial phase. Phase B was begun with 
specific emphasis placed on three representative payload configurations. 

The entire Phase B activity has been directed toward handling the three 
representative payload configurations in the most acceptable manner with the 
selected expendable second stage, and toward the design of the subsystems 
of the expendable second stage. Results of this activity are reported in this 
12-volume Phase B final report. This is Volume II, Technical Summary. 
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Volume II, 


Technical Summary, is divided into three books: 

Book 1 Expendable Second Stage/Reusable Booster System 

Definition 

Book 2 Expendable Second Stage Vehicle Definition 

Book 3 Booster Vehicle Modifications and Ground Systems 
Definition. 

This book is intended to be used together with .the other books of 
Volume II. Book 1 contains basic data on mission/system requirements, 
performance, trajectories, aerodynamics, stability and control, loads, 
heating, and acoustic environment. Book 2 is devoted to the definition of 
the selected expendable second stage, its subsystems, and overall ESS 
operation. Book 3 covers the definition of the ESS/booster separation sys- 
tem, modifications required on the reusable booster for ESS/payload flight, 
and the ground systems needed to operate the ESS complementary with the 
space shuttle. 
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1.0 INTRODUCTION AND SUMMARY 


.0 INTRODUCTION AND 
SUMMARY 




1. 0 INTRODUCTION AND STUDY OBJECTIVES 


A space shuttle system utilizing a reusable booster and orbiter that 
can transport personnel and cargo to low earth orbit and return personnel 
and cargo safely to earth is being evaluated through a preliminary design 
and development (Phase B) study. Future space exploration and operations 
will be greatly enhanced by the basic economic efficiency which will evolve 
through development of such a space logistics system. The shuttle system 
presently is being designed to handle payloads up to approximately 
65, 000 pounds. The cargo bay into which these payloads must fit. is cylin- 
drical and is 60 feet long and 15 feet in diameter Whereas most of the 
total projected payload spectrum can be handled by the shuttle, a significant 
number of payloads for the decade of the 1980's have been defined as much 
larger and heavier than can be placed in orbit by the booster /orbiter 
combination. 

To supplement the shuttle capability, a space shuttle system using 
an expendable second stage (ESS) with a reusable space shuttle booster has 
been under investigation for the past nine months of the Phase B Study. The 
prime objective of this supplemental study has been to determine the feasi- 
bility, cost effectiveness, and preliminary design of a system to be suitable 
for a wide variety of advanced space missions beginning in the last half of 
CY 1979. The results of the study will be available for comparison with 
results of past studies of all -expendable systems for launching the same 
types of large, heavy payloads 

On 14 September 1970, NASA authorized the Phase A/B Study for an 
Expendable Second Stage on a Reusable Space Shuttle Booster, as Exhibit B 
to Contract NAS9- 10960. Supplementary study during Phase A on a modified 
Saturn S-II as a candidate ESS was authorized by Change Order 1980 to 
Contract NAS7-200. During Phase B, which commenced on 1 February 1971, 
supplementary study was defined by Task Authorization 5 to 
Contract NAS7-200. Beginning in March 1971, additional supplementary or 
related technical effort by the IBM Corporation, on guidance, navigation, and 
control for the ESS was authorized by NASA. Results of this effort are 
utilized in this report. The entire final report is organized in accordance 
with Contract NAS9-10960, DRL MSFC-DRL-221 , Line Item 6, and DRD 
MA-078-U2, 28 August 1970. The document is submitted by North American 
Rockwell Corporation through its Space Division and contains results of 
design, performance, and resource studies performed during the Phase B 
portion of the contract. 
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As previously indicated, the study was divided into two sequential 
phases. Phase A and Phase B. The Phase A work concentrated upon such 
aspects as performance, configuration, and basic aerodynamic considera- 
tions to provide the foundation for a proposed single configuration for a 
analysis in the Phase B portion. Phase A required analysis and definition 
of space shuttle systems with an optimized expendable second stage 
(1) utilizing existing hardware, (2) space shuttle engines with 400, 000 pounds 
of thrust*, and (3) new hardware or (4) a combination of existing and new 
hardware. Further, the definitions of systems with minimum modified 
S-II stages and minimum modified S-IVB stages were included. 


The study depth was to be sufficient to permit a decision by NASA on 
whether to proceed with a particular approach or to eliminate all concepts 
from further consideration. To accomplish this objective, consideration 
was given to the following: 


1. The defined payload spectrum. 

2. The required operational characteristics. 

3. Identification of any modifications and the extent of penalties 
{if any) in payload and performance required to employ the 
reusable booster with the selected expendable second stage 
(but without incorporation into the Phase B space shuttle 
system study). 

4. Research, design, test and evaluation, production, and 
operational costs. 

5. Identification of cost, performance, and mission effectiveness. 


The contractor recommended that an ESS-derived from the Saturn S-II 
be investigated in the Phase B portion of the study. The recommended ESS 
main propulsion system featured two space shuttle orbiter engines and its 
liquid hydrogen tank was shortened by 99 inches. The results of the 
Phase A study were reported in December 1970 in the Interim Final Report 
(Phase A only), SD 70-607. A summary of these results is included in 
Volume -I, Executive Summary, of this report. 


*The thrust level for Phase B was increased to 550,000 pounds at sea level. 
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This volume of the final report. Volume II, Technical Summary, 
covers the selected expendable second stage/reusable booster system and 
consists of the following: 

1. Study objectives 

2. Mission/System requirements 

3. Study Approach 

4. System and flight characteristics and environment 

5. Analyses and design data generated during the Phase B study 

On 1 February 1971, a technical directive was received from NASA 
that indicated for the remaining portions of the Phase B Study emphasis 
should be placed on the short S-II stage with two space shuttle engines, 
Further, to facilitate an in-depth study up to mid- June 1971, baseline 
payloads should be consolidated into three. The specific payloads are 
indicated in Figure 1-1, along with the candidate payload spectrum for the 
Phase B study. Other ground rules to be used in Phase B were defined 
in an updated study control document dated 1 February 1971 and are 
included in Section 2, 0, Book 1, Volume II, 

1.1 GENERAL, ARRANGEMENT 

The ESS is a modified Saturn V S-II. The primary structure includes 
the S-II LO 2 tank, the LH 2 tank with one 99-inch cylinder removed, a new 
thrust structure, a new aft skirt, and a modified forward skirt. The 
forward and aft skirts contain provisions for mounting the ESS to the B-9U 
booster. The ESS general arrangement is shown in Figure 1-2. 

The main propulsion system employs two space shuttle orbiter engines 
mounted to the new thrust structure. Air-stream deflectors are attached 
to the aft skirt to avoid direct air stream impingement on the engines. 

An auxiliary propulsion system employing two 10, 000-pound-thrust 
OMS engines is also attached to the thrust structure. This system is 
required to perform the circularization maneuver after insertion into orbit 
and to provide deorbit impulse. Fourteen 2, 1 00- pound -thrust ACPS 
(attitude control propulsion system) thrusters are mounted in the two LH 2 
feedline fairings to provide vehicle pitch, yaw, and roll control. These 
ACPS thrusters and OMS engines are fed by four LH 2 and one LOg tank 
mounted in the thrust structure. 
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A docking port is integrated into the LH 2 feedline fairing at 
Position III. This docking port is provided to mate with the orbiter for 
equipment retrieval prior to deorbit. 

The avionic equipment used for guidance, navigation, and control is 
located in both the forward and aft skirts and on the thrust structure. Some 
of the more expensive avionic equipment is located in the aft end of the ESS 
to facilitate equipment recovery. 

1.2 ESS WEIGHT AND MASS PROPERTIES 

ESS weight and mass properties are summarized in Tables, 1-1, 1-2 
and 1-3. Further weight data and mass properties are delineated in 
Volume 4 of this report. 

1.3 PAYLOAD ATTACHMENT 

Two payload attachment structures have been identified for the 
three payload configurations. The 33-foot-diameter MDAC space station 
and reusable nuclear stage (RNS) require a separation plane at the ESS/ 
payload interface. The space tug requires a transition cone to reduce from 
the ESS 33-foot diameter to the 15-foot diameter of the tug. Separation of 
the space tug is required at the transition cone and payload interface. 

The method of structural separation selected for the MDAC space 
station and the RNS is a confined explosive charge contained in a short 
cylindrical segment. This segment would be added between the ESS forward 
skirt and the payload aft skirt (see Figure 1-3). The separation segment is 
made up of two sections, one forward and one aft of the separation plane. 
These sections, are 7075 -T6 aluminum alloy channels with integrally 
machined stiffeners. Compression loads are transferred from the ESS 
forward interface angle through the separation segment to the payload. 
Tension loads are transmitted from the payload skirt stringers to the 
separation segment by stringer end fittings. Tension straps are employed 
to ti-ansfer the load across the separation plane. Radial shear loads are 
transferred through shear pins in the flange at the separation plane. 

Separation is made by detonation of confined explosive charges to 
sever the tension straps. It is proposed to use an explosve charge 
contained within a continuous thin steel housing. The original cross- 
sectional shape of the change assembly is a flat oval. After ignition, the 
covering sheath expands to a circular cross-section. The deformation of 
the covering sheath breaks the tension straps. 
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Table 1-3. Systems Mass Properties, ESS/RNS 
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The transition cone to adapt the space tug payload to the ESS is an all 
aluminum structure employing skins, stringers, and frames (see Fig- 
ure 1-4). This structure is similar to the Saturn V cone located between 
the S-II Stage and the S-IVB Stage. The fifteen-degree cone angle has been 
retained along with the basic structural design. Additional length has been 
added to provide the reduction to 15 feet in diameter. 

Separation of the tug (payload) will be at ESS Station 1215, the 
adapter /payload interface. The separation system proposed for this payload 
is identical to the Space Station system. 

The payloads are considered as passive during separation and will be 
physically separated by the forward facing ACPS thrusters on the ESS. 
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2. 0 ESS DESIGN 



2. 1 STRUCTURAL SUBSYSTEM GROUP 

The ESS structural design has been established to be compatible with 
loads applied from three payload configurations; the MDAC space station, 
the NR space tug, and the RNS. Structural attachment to the booster is 
provided at two points on the forward and aft skirts. Boost loads are 
transferred from the ESS to the booster by a separat.on system linkage 
defined in Volume II, Book 1, Section 5. 1.3, of this report. 

The structural subsystem is divided into primary vehicle structure and 
the thermal protection system. Primary structure includes all skirts, 
tankage, and thrust structure (see Figure 2-1), and the thermal protection 
system includes the vehicle sidewall insulation and the heat shield. 

This study defines the structural configuration required to perform 
an ESS mission. Maximum use of the current S-II design was considered 
throughout the study to minimize development and qualification requirements. 
Where ESS loads exceed current S-II capability, the structural design 
concept utilizes reinforced S-II structure. 

Detailed calculations used in establishing sizes are contained in the 
Design Data Book, Volume XII. 

2. 1. 1 Structural Criteria and Loads 


Criteria and loads considered in this report include primary body loads 
generated during prelaunch and boost phases by winds, control system 
response, combined system aerodynamics, and vehicle trajectories. Loads 
were determined for prelaunch, maximum q alpha, initial maximum 
acceleration and end boost using these criteria with structural response 
dynamics and ajeroelastic effects. Special trajectories were determined for 
each of the three payload configurations to minimize loads imparted to the 
B-9U booster. The ESS body loads (distributed shears and moments) were 
converted to running loads (N x ) and compared to the structural capability 
of the S-II- 11 design. 
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Structural Criteria 



The following criteria were used in establishing the structural design 
for the ESS vehicle. 

1. Baseline Payloads. For this study, load analyses are limited 
to the following three representative payload configurations; 

a. Nuclear stage without engine (NR): weight, 83, 000 pounds 

b. Space tug, geosynchronous mission (NR): 
weight, 107, 180 pounds 

c. Space station (MDAC) — Single Launch Configuration: 
weight, 176, 960 pounds 

2. Configuration. The baseline vehicle is the B-9U booster with an 
ESS/payload. The total vehicle liftoff weight ranges from 

4, 217, 000 to 5, 190, 000 pounds. 

3. Propulsion. The rocket engine used for this study is the space 
shuttle high performance engine as identified in 

Drawing 13M 15000, space shuttle vehicle and engine 550K(SL) 
interface control document. 

4. Factor of Safety. The factor of safety will be 1.4. 


5. Design. Design that would compromise the booster sufficiently 
to preclude its use with the orbiter will not be considered, and 
the load- car rying capability of the booster primary structure 
shall not be exceeded. 

6. Minimum Modification. Minimum modification definition is 
"using present stage tankage. “ 

7. Launch Capability. All-azimuth launch capability. 

8. Load Factors. The vehicle trajectory load factors will not exceed 
3 g for manned missions and 4 g for unmanned missions after 
staging. 

9. Ground Winds. Ninety-nine-percentile winds for a one-day 
exposure per NASA Technical Memorandum 53872 are used with 
the vehicle fueled and pressurized. Ninety-nine-percentile winds 
for a 14-day exposure are used with the vehicle unfueled and 

un pressurized. 
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10. Flight Winds . A 95 percentile wind profile plus a 9 meter per 
second embedded gust per NASA Technical Memorandum 53 872 is 
used for determining loads. The wind shear and the quasi-square 
wave discrete gust must be multiplied by a factor of 0. 85 when 
constructing the synthetic wind profile. 

11. Trajectory. The trajectory data used for this study are defined 
in Volume II, Book 2, Paragraph 5. 2.2 of this report. 

12. Control. The control requirements for the determination of loads 
will be those required to maintain trimmed flight. In the vicinity 
of maximum dynamic pressure, the pitch loads will be predicated 
on the product of dynamic pressure and angle of attack (q alpha) 
between- the limits of +1500 psf-degree and -2900 psf-degree. 

The yaw loads in the vicinity of maximum dynamic pressure will 
be predicated upon a angle of ±4 degrees. 

13. Weight and Center of Gravity. Table 2-1 defines the weight and 
center of gravity information used for the loads analysis. These 
data differ slightly from the final weight data iteration. The 
effect on loads is estimated to be small. 

14. Thermal. The thermal data used for the forward bulkhead 
structural evaluation are shown in Figure 2-2. The aerodynamic 
heating rates are based on a MDAC space station payload. It is 
assumed for this study that the TPS will limit the structural 
temperatures to those experienced on the Saturn V program. 

Loads 

The ESS in conjunction with three separate payloads — Reusable 
Nuclear Stage, MDAC space station, and space tug — was considered in the 
formulation of the ESS /booster attach fitting loads and the ESS body loads. 
The body loads presented here do not include the influence of the fittings; 
therefore, to define a balanced system, the unbalanced shear, bending 
moment, and axial load must be balanced .by the fittings. The loads were 
so presented to facilitate the optimization of the attachment design; this 
eliminated the necessity of reconstructing load diagrams each time an 
iteration in fitting geometry or design took place. The axial loads, as 
presented, act at the ESS centerline and do not reflect the effects of internal 
pressure. All loads presented are limit. 

Prelau nch Loads Body Loads. Two wind conditions were considered 
for the prelaunch loads; i. e. , a 14-day exposure was used for the unfueled 
vehicle while a 1-day exposure was used for the fueled vehicle. For both 
cases, 99 percentile winds were used. The fitting and body loads were 
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Table 2-1. Weight and Center of Gravity Data for Loads Analysis 


MISS TO ii /EVENT 

COMBINED 

ESS 

WEIGHT 

CG 

Z CG 

WEIGHT 

x„„ 

CG 

Z CG 

B-9U/ESS-I1DAC 







Lift-Off 

5190350 

2173 

71 

997900 

2224 

450 

Max. qoc 

3934100 

2336 

94 




Initial Max . g 

3163900 

2448 

117 




End Boost 

1810500 

2640 

217 




B-9U/ESS-RNS 







Lift-Off 

3957650 

2311 

56 

662820 

2252 

450 

Max. q <x. 

2871300 

2480 

78 „ 




Initial Max. g 

2032300 

2665 

no 




End Boost 

1477750 

2753 

166 




B-9U/ESS-TUG 







Lift-Off 

4534000 

2220 

51 

691616 

22U6 

450 

Max. q.^ 

3296800 

2402’ 

71 




Initial Max. g 

2472000 

2552 

94 




End Boost 

1504100 

2735 

170 



1 


X : Given in B-9U Body Stations 

Z CG : Given in Inches Above B-9U Centerline 


determined for the wind blowing in from ESS to booster (headwind), booster 
to ESS (tailwind), and a crosswind which is normal to both the headwind and 
tailwind. The effects of vortex shedding and a gust are included in the 
analysis. It is recognized that a definition of the dynamic effects, due to 
ground winds must be determined by wind tunnel tests; therefore, it is 
recommended that the prelaunch loads presented here do not form the basis 
for design which may penalize vehicle performance. Instead, they should 
form the basis for defining the need of wind tunnel tests and the necessity to 
consider ground-handling devices; e. g. , dampers to restrict the loads at all 
times to as late as possible prior to launch. The prelaunch body loads for 
the three configurations are contained in Volume XII, the Design Data Book. 
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Maximum Dynamic Pressure Body Loads. The maximum pitch loads 
in the vicinity of maximum dynamic pressure (q) were determined by using 
a q alpha of +1500 psf-degree (headwind) and -2900 psf-degree (tailwind). 

The maximum lateral loads in the region of maximum q were determined 
using a ±4-degree angle of yaw. These limits were the result of trajectory 
and control system studies which are discussed separately in Volume II, 

Book 1, Paragraph 5.2. The wind criteria used was 95 percentile scalar 
windspeed combined with 0. 85 of 99 percentile wind shears and a 99 per- 
centile gust. The body loads for the MDAC space station and RNS 
configurations with a q alpha of +1500 psf-degree (headwind) are presented 
in Figures 2-3 through 2-6, and for -2900 psf-degree (tailwind) in 
Figures 2-7 through 2-9. No side loads are to be combined with the 
maximum headwind and tailwind conditions. The maximum lateral loads for 
the two configurations are presented in Figures 2M0 through 2-15. The 
lateral load conditions require the combining of side loads with a set of pitch 
and axial loads. The lateral loads are due to the crosswind assumed 
effective for this condition. The pitch loads are those induced by maintain- 
ing a trimmed flight condition in pitch with no headwind or tailwind, and the 
axial loads are those induced by the drag, thrust, and inertia forces. The 
manner in which the lateral, pitch, and axial loads are to be combined is 
noted on the applicable figures. Tug loads are not critical for design and 
are contained in the Design Data Book (Volume XII). 

End Boost Body Loads. The end boost body loads were obtained by 
applying the normal and axial components of acceleration from the trajectory 
information presented for each configuration. Since the vehicle is 
essentially out of the sensible atmosphere, the loads are due to inertia 
effects only. The body loads for the three configurations are shown in 
Figures 2-16 through 2-19. End boost loads for the space tug payload 
configuration are contained in the Design Data Book (Volume XII). 

Fitting Loads. The ESS/booster attach fitting loads for the three 
configurations are summarized in Volume II, Book 1, Paragraph 5.2.2. 

The forward and aft fittings are considered effective in taking out pitch and 
lateral loads while only the booster forward fitting is considered effective 
in taking axial loads. The axial fitting load is assumed to act 202. 5 inches 
below the ESS centerline. 

Load Intensities 

The external distributed loads (moment, axial, and shear) shown in 
paragraph 2. 1. 1 under Loads for the three payload configurations were 
converted to distributed running load (N x ) and compared to current S-II 
capability. This comparison shows the locus of maximum body loads for all 
loading conditions and the S-II capability during first stage boost. 
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Figure 2-3. ESS/RNS Max qcv Pitch Plane Body Loads (Headwind) 
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Figure 2-4. ESS/RNS Max q a Axial Body Loads (Headwind and Tailwind) 
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Figure 2-6. ESS/MDAC 
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Figure 2-9. ESS/MDAC Max q a Axial Body Loads (Tailwind Case) 
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Figure 2-10. ESS/RNS Max qo Trim Yaw Body Loads (Tailwind Case) 
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Figure 2-11. ESS/RNS Max q& Trim Pitch Body Loads 
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Figure 2-12. ESS/RNS Max qct Trim Axial Body Loads (Alpha Trim Case) 
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Figure 2-13. ESS/MDAC Max q <y Trim Yaw Body Loads 
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Figure 2-14. ESS/MDAC 
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Figure 2-16. ESS/RNS End Boost Normal Body Loads 
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Figure 2-18. ESS/MDAC End Boost Normal Body Loads 






All ESS mission tension loads are well within the structural capability 
of the S-II design and therefore are not included in this report. 

Figure 2-20 shows the comparison of compression load intensities. 

The structural capability of the S-II design is exceeded in the forward skirt 
region by the RNS payload load intensities. This higher load dictates a 
small skin-stringer modification to the basic structural design. The 
minimum ullage pressure of 27. 5 psig was used in establishing the compres- 
sive capability envelope for the LH 2 tank. 

It should be noted that these load intensity figures are based on gross 
bending moments, axial and shear loads, and do not show the requirement 
for local reinforcement of the skirt structure to transmit the fitting loads. 
Local shear loads in these skirts are defined in paragraph 2.1. 2. 

2.1.2 Vehicle Structures 


The ESS vehicle structure has been designed considering maximum 
use of current S-II structural components. The vehicle structure consists 
of five major subassemblies; a forward skirt, an LH 2 tank, a LO 2 tank, an 
aft skirt, and a thrust structure. The structural modifications to the S-II 
required to support the ESS concept are delineated throughout this section. 
S-II structural modifications are summarized in Figure 2-21. 

The ESS vehicle was analyzed for the booster attachment loads by 
means of the NARSAMS Structures Analysis Computer program. This 
program is a modification of ELAS-A, Jet Propulsion Laboratory Technical 
Report 32-1240. NARSAMS uses a finite element stiffness method for the 
solution of linear equilibrium problems in structural mechanics. The 
methods used in this analysis are described in the Design Data Book 
(Volume XII), 

Forward Skirt 

The forward skirt of the ESS is a cylindrical semi-monocoque shell 
that connects the forward end of the LHg tank and the ESS payloads. This 
structure must also provide the forward attachment to the booster. The 
general arrangement of the forward skirt is shown in Figure 2-22. The 
length of the structure is identical to the S-II-15 (138 inches). However, 
with the short LH 2 tank employed on the ESS, the station notation is dif- 
ferent. The forward skirt is a simplified design where the intermediate 
"buffet" stringers were eliminated and constant thickness (0.100 inch) skins 
incorporated, and the stringer extrusions changed from 1. 50 inches high 
by 1.3 0 inches wide to 1. 875 inches high by 2. 00 inches wide. 


2-25 


SD 71-140-2 



OAD INTENSITY 







-27 


t-o 


Cfl 

a 


4 ^ 

0 

1 

r- 



STRUCTURAL ASSEMBLY 

REQUIRED MODIFICATIONS 

FORWARD 

A. 

FORWARD BOOSTER ATTACH 

SKIRT 


FRAME (REPLACES GENERAL 
STABILITY FRAME) 


B. 

SKIN THICKNESS INCREASED 
TO 0.10 IN (INTERMEDIATE 
STRINGERS DELETED) 


C. 

SMALL STRINGER THICKNESS 
INCREASE 


D. 

FORWARD ATTACH FITTING 
SUPPORTS 

LH 2 TANK 

A. 

BOSS PATTERN IN SIDEWALL 
FOR ERROSION BARRIER 
INSTALLATION 


. B. 

TWO FEED-LINE ELBOWS FOR 
ORBITER ENGINE 



CYLINDER NO. 5 DELETED 

L02 TANK 

A. 

SUMP FOR TWO ORBITER ENGINE 
FEED LINES 

AFT SKIRT 

A. 

AFT BOOSTER ATTACHMENT 
FRAME (REPLACES GENERAL 
'STABILITY FRAME) 

(STATION 41) 


B. 

SKIN DOUBLER AND STRINGER 
REINFORCEMENT FOR BOOSTER 
ATTACH LOAD EFFECTS 


C. 

AFT BOOSTER ATTACHMENT 
FITTINGS 


D. 

LENGTH ~ FROM 87 INCHES FOR 
S-II TO 252 FOR ESS 


E 

THRUST STRUCTURE ATTACH 
FRAME AT STATION 174.5 


F. 

FRAME AT STATION 223 CHANGED 
TO STABILITY FRAME AND MOVED 
TO STATION 206.5 


G. 

TWO FEED-LINE CUTOUTS 


H, 

ATTITUDE CONTROL SUPPORTS 


1. 

FRAME REINFORCEMENT (SHEAR 
DISTRIBUTION) 



Figure 2-21. Summary of Major S-II Stage Structural Modifications (Sheet 1 of 2) 
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STRUCTURAL ASSEMBLY 


REQUIRED MODIFICATIONS 

AFT SKIRT 

J. 

FAIRINGS AT AFT END TO PROTECT 

(CO NT) 


ORBITER ENGINES FROM AERO 
SHEAR 


K. 

FRAME AT STATION 240 MOVED 
TO STATION 238 


L. 

TWO ADDITIONAL GENERAL 
STABILITY FRAMES. 
(STATIONS 127 AND 79) 


M. 

ATTACHMENT FOR DOCKING 



ADAPTER SUPPORT STRUCTURE 

THRUST 

ALL NEW STRUCTURE INCORPORATING: 

STRUCTURE 




A. 

ATTACHMENT FOR TWO SS ORBITER 
ENGINES 


B, 

125,5 INCH HIGH CONICAL 
FRUSTUM (S-II IS 111 IN.) 


C. 

ATTACHMENT FOR TWO SS ORBITER 
OMS ENGINES 


D. 

REVISED STRINGER EXTRUSION 
SECTIONS AND SKIN THICKNESSES 


E. 

SUPPORTS FOR OMS PROPELLANT 
CONTAINERS 


F. 

SUPPORTS FOR ELECTRICAL 
EQUIPMENT 

INTERSTAGE 

NONE REQUIRED 



Figure 2-21. Summary of Major S-II Stage Structural Modifications (Sheet 2 of 2) 
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Skin and Stringer Structural Assessment. The skin and stringer 
shell is designed by the load intensities shown in Paragraph 2. 1. 1 under 
Load Intensities. These loads are slightly in excess of the baseline 
structural capability. Therefore, a small increase in stringer thickness is 
incorporated. Shear flows from the booster attachment loads are not 
severe enough to require any increase in the 0. 100-inch skin thickness. 
However, a skin doubler fourteen stringers wide is required to react the 
load from the separation strut. This is a large tension load (approximately 
400, 000 pounds) that is applied instantaneously upon initiation of the ESS 
booster separation sequence and diminishes rapidly as the separation 
sequence progresses. Since this load is reacted by axial tension in the shell 
and radial frame loads, all of the required reinforcement can be placed into 
the doubler and the stringers remain unaffected. All allowable stresses are 
consistent with those of S-II-15, and thermal environment is assumed to be 
the same or less than S-II-15 and will be controlled by insulation. 

Frame Structural Assessment. There are three frames in the 
forward skirt, located at Stations 767, 795, and 831. No frames are 
incorporated at either end of the structure. Shell stability is provided by 
the LH 2 tank at the aft interface and by the payload structure at the forward 
interface. The frames have the requirement of precluding failure of the 
shell by general instability plus reacting any direct or indirect internal 
loads. The frame at Station 767 is a stability frame and as such contains 
the same sections as the S-II-15 forward skirt frames. The two remaining 
frames are load frames and have sections greatly in excess of the stability 
requirement. The frame at Station 831 is the larger of the two. This 
frame is loaded by the booster vertical attachments approximately 78 inches 
each side of Position IV, and by side (lateral) loads at the centerline 
attachment on Position IV. Internal frame loads from the NARSAMS pro- 
gram solution are shown in Figure 2-23. Maximum loading is in the area 
of Position IV and is minimum at two points approximately 40 degrees each 
side of Position II. A tapered frame section is employed in order to 
minimize weight. The load is introduced through external fittings that pick 
up booster fittings or struts and full depth bathtub frame fittings. Critical 
loading occurs at maximum q alpha. The frame is constructed of 7075-T651 
aluminum alloy. 

The frame at Station 795 is loaded by the booster separation strut 
attachment fitting. This fitting is external to the forward skirt and is con- 
nected between the frames at Stations 795 and 831. This frame, like the 
Station 831 frame, has a tapered section and is constructed of 7075-T651 
aluminum alloy. 
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Tank Structures 



JLH 2 Tank. The LH 2 tank is an aluminum (A1 2014-T6) cylinder closed 
at the upper end by the forward bulkhead and at the lower end by the common 
bulkhead (Figure 2-24), 

The cylindrical portion of the LH 2 tank is a semi-monocoque structure 
consisting of closely spaced integral axial stiffeners and widely spaced 
circumferential frames riveted to integral rings. Except for a short 
portion at the bottom of the cylinder, the stiffeners are internal to the tank. 
The cylindrical section consists of four cylinder assemblies, each 99 inches 
long, and one cylinder assembly approximately 28 inches long. The tank 
wall design is identical to the current S-IX with the following exceptions: 
two 14-inch feedline outlets rather than five 8-inch outlets in cylinder 2; 
new integral bosses in all cylinders to accommodate the insulation erosion 
barrier and new fairings; deletion of cylinder 5 for the smaller fuel load 
requirements. 

The forward bulkhead is a modified ellipsoid of revolution. It is a 
monocoque structure consisting of twelve aluminum (A1 2014-T6) gore 
panels welded together along meridians and closed at the apex by a remova- 
ble door. The door is bolted to a ring which is circumferentially welded to 
the gore panels. A circumferential weld attaches the bulkhead to the 
cylinder just below its equator. This bulkhead is identical to the current 
S-1I. 


The common bulkhead is defined as a part of the LC >2 tank and is 
discussed in the LO 2 tank assessment. 

Forward Bulkhead Structural Assessment. The LIT, tank forward 
bulkhead is critical during first-stage boost and end ESS boost. Tempera- 
ture profiles on the bulkhead for these conditions are given in Figure 2-2. 
Based on these temperature profiles, the allowable differential pressure on 
the bulkhead can be calculated. Figure 2-25 gives the allowable pressure 
as a function of bulkhead radius. This allowable pressure is compared to 
the ESS LHg tank pressure requirements. As shown, the pressure require- 
ments are identical to the pressure allowables at a radius of 40 inches. 
Elsewhere, over the bulkhead, the pressure capability exceeds 
requirements . 

EHg Tank Wall Structural Assessment. The LH 2 tank wall is critical 
for stability during first stage boost. The tank wall compressive loading is 
compared to the ESS capability in Figure 2-20. As shown the capability 
exceeds the actual loading in all regions of the LHg tank. The tank wall is 
not critical for tension loading. 


2-34 


SD 71-140-2 





FORWARD 

BULKHEAD 


COMMON 
BULKHEAD (REF) 


Figure 2-24. 


ESS LH2 Tank 


2-35 


SD 71-140-2 



Figure 2-25. ESS LH 2 Forward Bulkhead Limit Pressure Capability 
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Maximum pressure loading on the tank wall occurs during first stage 
boost and end ESS boost. As shown in Figure 2-26 the pressure capability 
of the tank wall exceeds the pressure requirements. 

LO 2 Tank. The LO 2 tank is essentially a shell of revolution compris- 
ing a forward bulkhead assembly common to the LHbj tank and an aft 
bulkhead. Both bulkheads are the same contour as prescribed for the L 1 H 2 
tank forward bulkhead. A cutaway view of the LC >2 tank assembly is shown 
in Figure 2-27. 

The common bulkhead is an adhesive -bonded sandwich assembly 
employing facing sheets of 2014-T6 aluminum alloy and fiberglass /phenolic 
honeycomb core. The facing sheets of the common bulkhead are fabricated 
as complete shells, by welding twelve formed gore segments and a dollar 
section. The forward facing sheet terminates in the J-ring section that is 
welded to the L.H 2 tank wall. Waffle -stiffened gore sections are employed 
in the aft facing to provide shell stability under design collapse pressures. 

The EC >2 tank aft bulkhead consists of twelve formed gore segments 
and a large dollar section of 2014-T6 aluminum alloy. The dollar section 
incorporates an integral reinforcing ring to provide for attachment of a 
central sump at the apex of the bulkhead. An access door is provided in one 
of the gore panels above the dollar section. The gore segments near the 
equator contain integral waffle stiffening to maintain stability under 
compression loading. 

The LC >2 tank structure is identical to that used on the S-II with the 
exception of the central sump. This sump is a new design to accommodate 
the two larger engine feedlines. The fill and drain outlet on the sump 
remains identical to that of the S-II. 

Common Bulkhead Structural Assessment. The common bulkhead is 
critical in the collapse mode during prelaunch, with both tanks fully loaded, 
the LH 2 tank at maximum pressure, and the LO 2 tank vent valve open. As 
shown in the following listing, the factor of safety associated with collapse 
pressure on the common bulkhead would be slightly less than 1. 40. 


LH 2 tank ullage pressure 

-36. 0 

psia 

LH 2 tank fluid pressure 

- 0.,6 

psia 

LH 2 tank total pressure 

-36. 6 

psia 

LO 2 tank ullage pressure • 

414. 7 

psia 
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COMMON BULKHEAD 



Figure 2-27. ESS LO 2 Tank 





Common bulkhead differential 
limit pressure 


-21. 9 psid 


Common bulkhead capability 
(ultimate) 


-30. 1 psid 


Factor of safety 


-30. 1 

- 21 . 9 


1.37 


This condition is based on a failure mode where the LO? tank has suddenly 
lost its pressure. This condition presumes a LC >2 vent valve must malfunc- 
tion in the open position and the console operator fail to react in venting 
the LH 2 tank. For all other collapse loading conditions, the bulkhead factor 
of safety is high. 

The common bulkhead is also critical during prelaunch for the burst 
mode with the LC >2 tank at maximum pressure and the LIT? tank vent valve 
open. Figure 2-2 8 compares the maximum differential burst pressure 
across the common bulkhead to the burst pressure capability. 

LO 2 Aft Bulkhead Structural Assessment. The aft bulkhead is critical 
during first stage boost when maximum acceleration occurs in conjunction 
with maximum ullage pressure. Figure 2-28 compares the maximum pres- 
sure requirement to the bulkhead capability. As shown, the capability of 
the aft bulkhead well' exceeds the pressure requirements. 


Aft Skirt 


The aft skirt structure for the ESS, while not departing from the 
S-II-15 structural concepts, does incorporate a portion of the interstage into 
the aft skirt, resulting in a structure that is 165 inches longer than S-II-15 
(252 inches versus 87 inches). This concept is dictated by the all-azimuth 
launch ground rule that eliminates the possibility of incorporating a 
jettisonable interstage structure. Therefore, the aft booster attachment 
structure must be included in the aft skirt. The skirt is a semi-monocoque 
cylindrical shell extending from ESS Station 31. 0 to the attachment to the 
LO 2 tank at ESS Station 2 83. The two large booster attachment fittings 
extend from Station 31. 0 to Station 1-74. 5 and are located approximately 
140. 0 inches each side of Position IV. A small side-load fitting is located 
just off Position IV at Station 31. 0. The aft skirt also provides the 
attachment for the thrust structure and transmits ESS burn thrust loads. 
Aerodynamic deflectors are incorporated at the aft end of the skirt at 
Positions I and III to protect the ESS engines during first stage boost. The 
general arrangement of the aft skirt is shown in Figure 2-29. 


2-40 


SD 71-140-2 




© 

Skin-Stringer Structural Assessment. Two sets of internal loads are 
used to design the ESS aft skirt; the load intensity curves of Paragraph 2. 1. 1 
under Load Intensities and loads from the NARSAMS computer solution. 

The shell structure was first sized using the general load intensity curves, 
and since the maximum load intensity values are within the S-II-15 capa- 
bility, S-II-15 structure is used directly. The only change is the elimination 
of the stringer thickness increase between Stations 283. 0 and 238. 0. This 
is possible because of better definition of the Station 283. 0 discontinuity 
moment and the lower load intensity. This structure along with the booster 
attachment structure developed in the rough sizing analysis was then input to 
NARSAMS computer program. External loads representing boost of the 
MDAC space station and RNS payloads at maximum q alpha and end boost 
were run in the program. The critical condition for che shell structure 
as well as the frames was determined to be boost of the MDAC Space Station 
at maximum q alpha. Figures 2-30 and 2-31 present the resulting ultimate 
internal shell loads. Plotted are the skin shear flows and axial load 
intensity at mid bay between each of the aft skirt frames. In the undisturbed 
areas, the skin-stringer sizing is based on column stability requirements 
using stringer loads generated from the compressive load intensity curves. 
Skin gages are set using the shear flow curves from the computer solution, 
using a 40, 000-psi panel shear allowable stress. Skin gages taper from 
0. 400 inch near the SS booster attach fittings to a minimum of 0. 071 inch 
in the undisturbed areas. The skin is a constant 0. 071 inch in the upper 
three bays (Stations 174.5 to 283). 

The S-II-15 stringers, with a 0. 125 inch crown, 0. 090 inch side walls, 
and 5. 76 inch spacing, are adequate for most of the aft skirt. The lower 
load intensity allows the use of these stringers with larger frame spacing 
on ESS. The stringers in the vicinity of the booster attachment fittings are 
reinforced by the addition of straps on the crowns. Stringer and skin 
material is 7075 aluminum alloy. S-II-15 thermal environment is assumed 
for ESS design. Local insulation will be incorporated at any hot spot in 
order to keep maximum structural temperatures within the S-II-15 limits. 

Frame Structural Assessment. The aft skirt contains six frames 
which fall into two general categories; stability frames and load frames. 

The frames at Stations 206. 5 and 238. 0 are sized by their "El” requirement 
to preclude failure of the shell by general instability. This requirement is 
set by the shell compressive load intensity and the spacing of the frames. 
These two frames have an overall depth of eight inches. 

The load frames are at Stations 31. 0, 82. 5, 128. 0, and 174. 5. Their 
loading is taken from the NARSAMS computer solution. Figure 2-32 
presents the internal loads for the frame at Station 31. 0. This frame is the 
aft booster attachment frame, and is sized as a fifteen-inch-deep box 
section. The box section is employed to react torsional loads generated by 
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Figure 2-30. ESS MDAC Aft Skirt Shell Loading Intensity/ MDAC Payload (Sheet 2 of 2) 
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Figure 2-31. ESS Aft Skirt Shear Flow (MDAC Payload) (Sheet 1 of 2) 
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Figure 2-31. ESS Aft Skirt Shear Flow (MDAC Payload) (Sheet 2 of 2) 
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Figure 2-32. ESS /Frame, Station 31, Internal Loads (Sheet 2 of 2) 
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the booster attachment fittings. The internal loads for the frames at 
Stations 82. 5, 128. 0, and 174. 5 are closely comparable with the loads for 
174.5 being maximum. Therefore, the 174. 5 loads are used to size all 
three of these frames. These loads are presented in Figure 2-33. The 
frame at Station 174.5 is also subjected to thrust cone load conditions during 
ESS burn. However, these loads are not critical. All of the load frames 
are sized using 70, 000 psi allowable cap stress and 40, 000 psi allowable 
shear web stress. All of the frames are constructed of 7075 aluminum alloy. 

Fitting Structural Assessment. Shown in Figure 2-34 is a diagram 
of the ESS /booster attach fittings and the ultimate external applied loads for 
the critical condition (MDAC space station at maximum q alpha). These 
fittings are required to take the aft booster attach loads at two points and 
then distribute the loads into the aft skirt shell structure. The horizontal 
cross tie connecting the two fittings (shown in View A-A) is required to 
react the side loads (Py) generated by the angularity of the booster 
attachment struts. Sizing of the fittings is determined by the drag loads 
(P x ) and the moment caused by its offset from the aft skirt shell. The 
fitting is constructed of 7075 and 7079 aluminum alloys, with allowable cap 
stress of 70, 000 psi and allowable shear web stresses of 40, 000 psi. A 
relatively small side load fitting is attached to the skirt just off Position IV 
at Station 31.0. Small local reinforcements of the frame at Station 31.0 are 
required to accommodate this loading. 

Thrust Structure 


The ESS thrust structure is sized to support two orbiter engines and 
two OMS engines. The vacuum thrust for the main engine at the emergency 
power level used for analysis is 690, 000 pounds. The OMS engine thrust 
used is 10, 000 pounds. 

The two- orbiter engine concept employs a new conical frustum for the 
thrust structure. This cone, like the S-II-15 cone, is stabilized by a 
crossbeam. Differences in geometry of the larger engine require a greater 
distance between engine interfaces and the LO 2 tank sump. This generates 
extra space inside the thrust cone which allows for the LO 2 and LH 2 APS 
tanks to be located inside the cone. The basic structural elements of the 
S-II-15 thrust cone are maintained. Engine thrust and gimbal loads are 
reacted directly by thrust longerons. The skin is stiff enered by hat- 
section stringers and the shell is stabilized by ring frames and a crossbeam 
at the aft end to avoid adding an excessively large thrust frame. This beam 
provides an ideal mounting for the APS LO 2 tank. 


2-52 


SD 71-140-2 





LOAD (KIPS) 









o 

Incorporation of two orbiter OMS engines as the OMS requires the 
addition of support fittings and primary structure to the basic ESS two- 
orbiter engine thrust cone. Structural modifications are required to support 
the OMS engines, provide any needed thermal protection, and to support 
miscellaneous mechanical and electrical systems components. 

The concept is a skin stringer shell structure with internal ring 
frames. The aft frame is used to react kick loads from engine thrust. 
Crossbeam ties are incorporated with this frame to assure adequate 
stiffness to prevent engine compliance problems. Thrust longerons are 
included to react engine thrust, eccentric moments, and distribute engine 
loads into the shell by shear lag. The forward frame provides the attach- 
ment to the aft skirt and reacts the kick loads produced when thrust 
structure skin-stringer loads are reacted by the aft skirt. This frame must 
also work as a stability frame for both the thrust structure and the aft skirt. 

Although structural similarities between the S-II-15 thrust structure 
and the ESS concept may be used to establish the validity of employing 
common analysis methods, such practice cannot be extended to the structural 
test requirements. The greater thrust of the orbiter engines 
(1,380, 000 pounds versus 1,200, 000 pounds) and the less uniform application 
to the conical structure (two places versus five places) dictates that 
full-scale verification tests be performed on the new thrust structure for 
the ESS. This testing will be similar to the testing performed on the S-II 
thrust structure to verify integrity under the various thermal and loading 
conditions . 

OMS engine loads are small in comparison with the engine thrust loads • 
to which the thrust structure is designed. However, the OMS engine loads 
will be incorporated into the test program to verify the integrity of the 
engine attach structure and local fittings. 

The ESS thrust structure configuration and structural diagram is 
shown in Figure 2-35. The geometry is set to maintain growth potential to 
a chemical interorbital shuttle (CIS) application. Recent studies on the 
CIS require an aft docking adapter compatible with the space tug which 
makes the large base frame diameter necessary. ~ 

Design Assumptions. These assumptions are as follows: 


1. Two orbiter engines will be employed as main ESS engines 

2. Vacuum thrust is 690, 000 pounds (limit) and 966, 000 pounds 
(ultimate) 
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Engine precant is 13 degrees outboard (1 -degree compliance) 

4. Engine gimbal is ±7 degrees along 45 degree lines and 
±10. 5 degrees (pitch and yaw) 

5. Xg 52 and Xg 105 frames react kick loads 

Load Conditions. The following load conditions are used to determine 
the maximum loading on the various structural elements. 

Condition I. Symmetrical 12 degree precant 


Condition II. Hard-over gimbal 


one engine 12° + 10-1/2° = 22-1/2° outboard; other 
engine 12° -10-1/2° = 1-1/2° outboard 

Condition III. Hard-over gimbal; both engines in null radial position 
(12° outboard precant) but gimbaled 10-1/2° in pitch plane 

Condition IV. One engine out; other engine 12° + 10-1/2° = 22-1/2° 


Structural Assessment. The method of analysis used to size the 
thrust structure was to use the load conditions shown above to establish the 
"first cut” sizes of the structural members. The structure and critical 
load conditions (Condition I and Condition II) were then input tothe 
NARSAMS computer program. The NARSAMS structural model consisted of 
half of the thrust structure and half of the aft skirt from one bay aft of the 
thrust structure attachment to the joint with the LC >2 tank. Half of the 
structure is modeled because the structure is symmetrical. The program 
solves for the internal loads in the structural elements. These internal 
loads were then used to redefine the sizes of the structural members. A 
summary of the internal loads and structural sizing is presented in the 
remainder of this section. All sizing shown is based on the use of 7075- T6 
and 7079-T651 aluminum alloys. 

Skin and Stringers . Figures 2-36 and 2-37 show the thrust structure 
shell compressive load intensity and skin shear flow. The loading is 
plotted at mid-bay between frames and s panwise for one -quarter of the shell 
circumference. Figure 2-35 delineates the resulting skin and stringer 
thicknesses. Tapered skins and stringers are employed in order to achieve 
a more efficient "shear lag" load distribution and reduce shell weight. 

The thrust cone shell is designed by the critical condition of "two engines on 
0° gimbal" (Condition I). Allowable stresses used for design are consistent 
withS-II-15 values. These are an average of 15, 000-psi compression 
stability (column buckling), and 27, 500-psi shear (skin panels). 
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Figure 2-37. Thrust Structure Skin Shear 
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Frames . There are five frames in the thrust structure assembly. 

All must serve to preclude failure of the skin stringer shell by general 
instability. The frame sections necessary to react the applied loads, 
however, are in excess of the moment of inertia requirement for general 
stability. Three of the frames (at Station 52, Station 105, and Station 174.5) 
are heavily loaded, and the other two (at Station 78. 5 and Station 140) are 
lightly loaded and approach stability frames. The frame at Station 52 
functions as a kick frame to react loads from longeron bending and cone 
reactions to engine thrust. This frame must also react engine thrust 
components that arise from the engines being gimbaled tangentially to the 
frame. The frame at Station 105 functions as a kick frame to react loads 
from longeron bending. The frame at Station 174. 0 is the cone forward end 
frame and provides the attachment to the aft skirt. During ESS burn it is 
loaded by loads generated when the thrust structure skin- stringer loads are 
reacted by the aft skirt. However, loads produced by the aft skirt booster 
attach fittings comprise the critical loading for this frame and sizing is 
presented in the aft skirt discussion. 

Figures 2-3 8 through 2-42 summarize the internal moment, shear, 
and axial load of the frames at Stations 52 and 105. Figure 2-35 defines 
the resulting frame sections required. 

The heavily loaded base frame at Station 52 is designed by Condition I, 
"Two engines on 0.° gimbal. " Stress allowables of 70, 000-psi tension, 

60, 000-psi compression, and 41, 000-psi shear were employed in sizing 
this frame. The forward kick frame at Station 105 is designed by 
Condition H, "One engine out hard over gimbal. " Working stresses are 
consistent with those used for the frame at Station 52. Frame depths shown 
were chosen by a preliminary design evaluation and are considered a point 
for optimization in subsequent design refinement. 

Internal loads are not presented for the two lightly loaded frames since 
they are small, and only insignificant differences between load conditions 
exist. The frame at Station 78.5 is interrupted at four places by large 
support fittings for the APS LHg tanks, and at two places by the main engine 
longerons. Therefore, this is referred to as a partial frame. Both of 
these frames (at Stations 78. 5 and 140) provide support points for the APS 
L 1 H 2 tanks. Consequently, these frames are designed for a combination of 
APS tank loads and cone shell secondary loads. Because of the light 
sections, the allowable cap stress is limited to 50, 000 psi in their design. 

Longerons. The longeron design is similar to the S-II-15 with a 
heavy section for bending plus axial loading from the base frame to the 
forward kick frame at Station 105, and a light section for axial loading from 
the forward kick frame to the top of the cone. Internal loads from the 
computer program solution for the longerons are presented in Figure 2-43. 
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The critical design condition is "Two engines on 0° gimbal, " (Load 
Condition I}. Since the longeron will be machined from a forging, the allow- 
able stress of 60, 000 psi is used for sizing. Section depth for the frame can 
be optimized in subsequent design refinement. 

Cross -tie Beam and Supports. 



The general arrangement of the cross -tie beam and supports is 
indicated in the sketch above. This beam system provides the support and 
attachment for the APS LC >2 tank and stiffeners, the base frame and the aft 
end of the shell. The system is similar to the center engine support beam 
on the S-II-15 thrust structure, however, in this case the beam ends are 
fixed to reduce weight. Beam bending moments from the program solution 
are shown in Figure 2-44. Indicated on each moment curve is the corres- 
ponding axial load. The critical design condition for the system is hard- 
over gimbal (Condition II). Loads from the APS LC >2 tank were used in 
conjunction with these loads to establish the required sections. The 
allowable stresses used in the beam and support sizing are 60, 000-psi 
tension or compression for the caps and 27, 500-psi shear for the webs. 

2.1.3 Thermal Protection System (TPS) 

TPS Design Requirements 

This insulation study effort was undertaken to establish a feasible 
insulation system, satisfying the requirements imposed by ESS missions. 


2-69 


SD 71-140-2 



4 


i 

o 


W 

d 

-4 


4 ^ 

O 

M 


2 ENG 0 DEG GIMBAl CONDITION I 

— — — 2 ENG 10.5 DEG GIMBAL CONDITION II 

- — - 1 ENG OUT 10.5 DEG GIMBAL CONDITION IV 




THRUST CONE 
INTERSECTION 


PAX = -282.1 KIPS 
Pax = -277.1 KIPS 
Pax = -184.3 KIPS 




Figure 2-44. Cross-Tie Beam, Xg-52 and Support Bending Moment 



o 

These missions involve boosting space station, reusable nuclear shuttle and 
space tug payloads into low earth orbit. In this application, the require- 
ments for the insulation system are: 

1. Protection of propellant tanks from excessive aerodynamic 
heating, induced during first stage boost, to maintain proper 
propellant conditioning for engine start. 

2. Protection of engine compartment systems and structure from 
excessive heating. 

Four areas have been identified that require insulation and thermal 
protection to satisfy the above requirements: 


1. LH 2 tank sidewall 

2. Forward skirt 

3. Aft skirt 

4. Engine compartment 
General Description 


For all surfaces of the Ebb, sidewall and the lower part of the forward 
skirt, the thermal protection system consists of spray-on foam insulation 
covered with a polyimide, honeycomb erosion barrier (Figure 2-45). In 
local hot spot areas the erosion barrier is protected by an ablative material. 
Ablative material is also required in local hot spot regions of the forward 
and aft skirts. 

The ESS base area is completely closed out with a heat shield to 
protect structure and equipment from the back flow of hot plume gases 
during main engine burn. A rigid heat shield covers all of the area except 
for a flexible curtain around each of the two engines to permit gimbaling. 
S-II base heat shield materials are used in both the rigid panels and flexible 
curtains and provide adequate temperature margins. Attachment of the 
curtain to the rigid heat shield includes provisions for release to permit 
engine removal while in orbit. Access for removal of electronic packages 
mounted on the thrust cone structure is accomplished through hinged rigid 
panels . 
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The heat shield is attached to the aft skirt frame at Station 37 and 
supported inboard by the thrust cone through stand-off attachments, (see 
Figure 2-46). 

Thermal Environment 

The thermal environment of the ESS consists of aerodynamic heating 
during booster ascent, orbital heating, ACPS engine plume impingement 
heating, and base region heating due to flow reversal resulting from the 
main propulsion system (MPS). 

Aerodynamic Heating. Temperatures resulting' from aerodynamic 
heating were calculated for the forward skirt, LH^ tank sidewall insulation, 
and aft skirt/interstage areas in order to determine critical areas where 
additional thermal protection is required. The forward and aft skirt 
configurations analyzed were similar to the aluminum skin-stringer designs 
used on the S-II. The LH^ tank sidewall insulation design differed from that 
of the S-II in that the spray-on foam insulation was protected by a polyimide 
honeycomb erosion barrier. Peak temperatures, shown in Figure 2-47, 
were calculated for three aerodynamic heating environments representing 
effects of KNS, MDAC space station, and space tug payloads. The aero- 
dynamic environments are shown in Volume II, Book 1, Paragraph 5.2.2, 
and include basic heating plus booster interference heating, payload 
protuberance heating and local protuberance heating where applicable. 

Figure 2-47 identifies the type of thermal protection required on 
various areas of the vehicle. The shaded areas will require an ablator and 
the slashed areas will need insulation to maintain allowable temperatures. 
Ablative material is recommended for use in higher aero heating protuber- 
ance regions in the vicinity of the booster-to-ESS attach fittings. A light 
weight insulation material will be used in other areas where thermal 
protection is required. Temperature histories for Region B of Figure 2-47 
are shown in Figures 2-48 through 2-50 for RNS, MDAC Space Station and 
Space Tug payloads, respectively. 

ESS base region temperatures were calculated for the external and 
internal surfaces of the thrust structure, rigid base heat shield, flexible 
curtains, APS LC^ tank heat shield and OMS engine supports. The tempera- 
tures were based on engine exhaust heat rates, shown in Volume II, Book 1, 
Paragraph 5.2. 2, for an aft skirt which is retained for the entire ESS 
mission. Initial calculations for the external and internal thrust structure 
surfaces yielded peak temperatures of 550 and 650 F, respectively, as 
shown in Figure 2-47. Both of these peak temperatures exceed the 
allowable temperature of 3 50 F requiring that the entire base region be 
protected from heating by engine exhaust gases. 
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Figure 2-47. Skin Temperature Due to Aerodynamic Heating During Boost 









Figure 2-48. ESS Temperature Histories With RNS Payload for 

Region B of Figure 2-47 
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Figure 2-49. ESS Temperature Histories With MDAC Space Station Payload 

for Region B of Figure 2-47 
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Figure 2-50. ESS Temperature Histories With Space Tug Payload 

for Region B of Figure 2-47 
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Base Heating , A rigid heat shield, similar to the S-II rigid heat 
shield, was designed to close out the entire base area at the aft end of the 
interstage as shown in Figure 2-47. A heat shield of the same design is 
used to protect the APS LOg tank which extends below the thrust structure. 
Flexible curtains, of the design used on the S-II, close out the areas 
adjacent to the orbiter engines. Figure 2-51 presents peak temperatures 
predicted for the base region utilizing the proposed thermal protection 
system. The temperatures for the external and internal thrust structure 
surfaces will be reduced to well below their allowable temperatures. The 
peak temperature of 1370 F predicted for the flexible curtain is well below 
the S-II flexible curtain allowable temperature of 1650 F. The rigid heat 
shield and APS LOg tank heat shield predicted peak temperatures are 
790 F and 850 F, respectively. These are also well below the allowable 
temperature of 1550 F for the S-II heat shield. The predicted peak 
temperature for the OMS engines supports was 1230 F, which is above the 
allowable temperature of 900 F for stainless steel and therefore a protective 
shroud will be required around the .supports. 

ACPS Plume Impingement Temperatures. A peak temperature of 
2300 F was calculated for the ESS aft skirt when using the ACPS plume 
impingement heat rates presented in Volume II, Book 1, Paragraph 5.2.2. 

In order to reduce the predicted structural temperatures to the allowable 
temperature of 250 F, a thermal protection system will be required on the 
aft skirt and air stream deflector and on the tank wall under the forward 
facing jet. The optimization of the thermal protection system has not been 
included and will depend on duration and number of times of engine firing as 
to the type of system such as insulation, ablators or deflectors. 

Design Loads and Criteria 

The following loads and criteria were used as a basis for development 
of the thermal protection system. 

1. Ground-hold boil-off of LH 2 shall be limited to 6 percent per hour. 

2. Boost heat leak shall be limited to 20.9, 000 Btu per mission. 

3. Sidewall insulation system shall be capable of resisting 
associated acoustic loadings in localized areas. 

4. The erosion barrier shall be designed to permit expansions 
and contracting of the LH 2 tank defined in Table 2-2. 


2-81 


SD 71-140-2 



TEMPERATURE (F) 


THRUST STRUCTURE TEMPERATURES 



0 TOO 200 300 


TIME FROM ESS IGNITION (SECONDS) 


2-82 

LOCATION AND 
DESCRIPTION 

PEAK 
TEMPS -F 


A-FLEXIBLE CURTAIN 

1370 

cn 

B-RIGID HEAT SHIELD 

515-790 

0 



-vl 

C APS LOX TANK H/S 

850 

H— 1 



1 

H-* 

D-OMS ENGINE SUPPORTS 

1230 





E-THRUST STRUCTURE 

LESS THAN 0 

ro 

EXTERNAL 



F-TH RUST STRUCTURE 

LESS THAN -50 


INTERNAL 



VIEW A- A 




Figure 2-51. ESS Base Heating Temperatures 




© 

Specific requirements for the base region are as follows: 

1. Closeout skirt base area from high-temperature exhaust gases to 
maintain structure below 350 F. 

2. Provide for maximum engine gimbal of ±10. 5 degrees in the pitch 
and yaw planes with the nozzle retracted or extended. 

3. Accommodate relative structural and thermal deflections between 
thrust cone attachment and skirt frame. 

4. Withstand a pressure gradient of 0. 5 psi acting aft during launch 
along with an acoustic environment of approximately 150 db. 

5. Perform, heat shield functions during main engine burn with a 
pressure gradient of 0. 1 psi acting forward. 

6. Provide for main engine removal while in orbit. 

7. Provide access for electronic package removal while in orbit. 

Functional Interface and Support Requirements 

No TPS functional or support requirements have been identified for 
the ESS vehicle. 

Maint enan c e 

Special maintenance is not needed to support the ESS vehicle because 
of the simple installation requirements. Deficiencies in the spray foam 
insulation can be corrected by removing the existing foam and respraying 
with new foam in the affected area. The polyimide sandwich erosion barrier 
panels are relatively inexpensive and easily replaced when defects appear. 

Thermal Structural Concepts Trade 

Thermal analysis methods are described in Volume II, Bookl, and in 
Volume XII. Thermal environment on the ESS in general is similar to 
conditions investigated in past studies. (Refer to SD 70-684, Saturn INT-21 
Launch Vehicle, Task 10). ESS/Reusable Booster interference and local 
heating effects have been the area of primary investigation. Material 
selection for thermal protection was based on trade studies performed on 
previous S-II programs and on S-II experience. Selections based on these 
previous programs include. 
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1. NOPCO BX-250 spray foam insulation was selected by virtue of 
its proven performance on Saturn V lunar orbital missions. 

2. Polyimide sandwich erosion barrier was selected for its top 
rating on- a system evaluation trade. The table included factors 
such as performance, cost, weight, and ease of manufacture. 

Design Analysis 

Insulation. The basic sidewall and forward skirt insulation consists of 
spray-on foam, covered with an erosion barrier. From S-II programs and 
follow-on studies, it has been determined that NOPCO BX-250 spray foam 
will adequately function as a thermal protection system provided it is 
protected from aerodynamic erosion during atmospheric boost. For the 
ESS program, it is proposed that the shingled type ship-lapped aerodynamic 
erosion barrier be used to protect the fragile insulation systems (Fig- 
ure 2-45). 

The erosion barrier is composed of 60- by 66-inch overlapping panels 
of sandwich construction. The core of these panels is heat resistant phenolic 
honeycomb. Both top and bottom facing sheets are of polyimide composite; 
they are bonded to the core during the curing process by an adhesive 
contained within the sheets themselves. 

Considerable analytical evaluation and studies have been performed on 
this configuration, all leading to a feasible design concept; however, precise 
acoustic, flutter and shock wave analysis are presently beyond the state-of- 
the-art and require development testing. It is anticiapted that there will be 
design modifications after wind tunnel and acoustic testing; however, the only 
foreseeable basic problems, however, are possible panel stiffening with the 
attendant weight increase. This is not considered to affect design 
feasibility. 

The erosion barrier panels are attached to the sidewall with phenolic 
and fiberglass spacers, which are threaded into the sidewall bosses. The 
spacers are provided with threaded inserts, and the erosion barrier con- 
tains a hardspot at each point of attachment to the spacers. Attachment is 
accomplished using standard screws and washers. 

Each erosion barrier panel has a rectangular, eight-hold bolt pattern 
(33 by 31 inches), which is located off center in order to rigidly fix one 
point of the panel. It is believed that the remaining three corners can 
obtain flutter resistance through the clamping action of the surrounding 
panels. 


2-85 


SD 71-140-2 



Because of severe thermal gradients established by the LH 2 tank 
loading operation and during the boost phase of the flight, the erosion 
barrier must be capable of accommodating expansion-contraction behavior 
of the tank sidewall. A system of slotted and oversize holes at the erosion 
barrier attach points will permit the panels to slide with respect to the 
sidewall and with respect to each other. Thus, strains due to expansion and 
contraction are relieved. In addition, a space must be left between adjacent 
panels to avoid expansion-contraction interference. These spaces are 
covered by the overlapping of the close-out edge of one panel onto a joggle 
in the adjacent panel (Figure 2-52). 

Through aero-shear testing it has been determined that the maximum 
temperature to which the erosion barrier can be exposed is 900 F. On the 
ESS, however, the effects of multiple protuberances and the attachment 
fittings to the shuttle booster cause localized areas of excessive heating 
(hot spots) which are identified in Figure 2-47. After a study of hot spot 
problems, it was elected to cover these regions of the erosion barrier 
with a spray-on ablative coating. Follow-on analysis and testing will be 
needed to specify an ablative material; however, some leading candidates 
are: 


Firex 10-035 filled modified epoxy 

Firex 250 filled polyurethane 

D. C. 93-027 silicone elastomer 

Korotherm 790-005 silica filled isocyanate 

Rigid Heat Shield. The rigid heat shield is fabricated of two 1-inch- 
thick phenolic impregnated glass honeycomb panels bonded together to form 
a 2 -inch section. The aft half is filled with silica spheres for greater 
insulation. The forward half, at a lower temperature, provides the 
necessary strength. Two-ply glass fabric is used for the face and middle 
laminates. Inserts for structural attachments are potted in a thixotropic 
adhesive. 

A major portion of the base area is made up of flat panels forming an 
in-station plane bulkhead at Station 37. A rigid hemispherical dome covers 
the protruding APS LO^ tank located on the body centerline. 

Thirty-degree truncated cones, extend forward from the flat panels 
along the engine null centerline to provide for the flexible curtain attachment. 

Figure 2-53 defines the preliminary design concept for the ESS 
vehicle. 


2-86 


SD 71-140-2 




© 

Flexible Curtain . The material and design of the flexible heat 
shield curtain is essentially the same as for S-II. S994 glass fabric facings 
enclose a 0. 25-inch high silica batt. The curtain forms a gas and heat 
barrier between the engine heat shield and the rigid heat shield cone. The 
attachment to the engine may be either by a tension band or a clamping 
ring secured by bolts. 

To provide for engine removal while in orbit, a spring-loaded ring 
clamps the curtain to the heat shield cone. A tension band preloads the 
ring to a configuration which will clamp and hold a glass rope welding 
fabricated in the edge of the curtain. Captive explosive bolts separate the 
tension band, allowing the ring to release the curtain. All other parts are 
held captive. Testing will be required to verify the curtain separation 
system. 

The configuration in which the curtain drapes inward toward the engine 
gimbal point was selected because of limited radial clearance between the 
engine envelope and the structural frame. It is believed that adequate 
displacement can be attained; however, a simulated mock-up will be required 
to optimize and determine flexure limits. 

The heat shield panels nestle inside the inboard cap of the aft skirt 
frame and butts against a flange, attached through a ring flush to the forward 
face of the frame. The thrust structure provides inboard panel support 
through short struts or formed sheet metal stand-offs. The relative deflec- 
tion between thrust cone and aft skirt frame must be considered for these 
attachments. 

The OMS engine thrust structure consists of a truss with three struts 
each which penetrates the base heat shield and attach to the thrust cone. 
Cutouts in the honeycomb heat shield are required for installation. Flexible 
curtain material will be used to close out the area around each strut. Some 
form of thermal protection may be required for the OMS engine thrust 
structure protruding aft of the heat shield. 


2-88 


SD 71-140-2 



2. 2 PROPULSION SUBSYSTEM GROUP 



The propulsion subsystems consist of the main propulsion subsystem 
and the auxiliary propulsion subsystem. The main propulsion subsystem 
provides the expendable second stage velocity increment necessary to place 
the stage in initial earth orbit. The auxiliary propulsion subsystem is 
utilized for changing orbits, deorbit, attitude control, and for rendezvous if 
it is performed. 

2. 2. 1 Main Propulsion Subsystem 


The main propulsion subsystem utilizes two space shuttle orbiter 
engines to provide the required impulse to place the ESS in initial orbit. 

The engines are assumed to be GFE and are in accordance with 
ICD 13M15000B except where noted. The main propulsion subsystem 
includes all assemblies required to support main engine burn. The sub- 
system does not include the propellant tanks, which are structural, or controls, 
instrumentation, etc., which are part of the avionics subsystem groups. The 
main propulsion subsystem is shown schematically in Figure 2-54. 

Design Requirements 

The design requirements of the main propulsion subsystem are set by 
a number of considerations including the ESS general arrangement, trajectory, 
stability and control, the study control document, and the engine interface 
requirements. The main propulsion subsystem must satisfy the engine 
interface requirements documented in "Space Shuttle Engine (SSE)/ 
Expendable Second Stage (ESS) Interface Requirements," Appendix B of 
Volume VI of this report. The main propulsion subsystem must fulfill the 
interface requirements for the time duration dictated by the mission 
trajectory. 

The major design requirements for the main propulsion subsystem 
assemblies are as follows: 

1. Space Shuttle Orbiter Engines. The SSEO' s provide the velocity 
increment necessary to place the ESS in initial earth orbit. The 
engines must be installed so that the vehicle is controllable and 
the engines serviced per ICD 13M15000B. 

2. Propellant Feed, Recirculation, Valve Actuation, Pogo 
S uppression, and Fill and Drain . Propellants must be applied to 
the engine at the required flowrates; adequate preconditioning 
must be’ performed to ensure properly subcooled propellants at 
engine start; the interaction between structure, feedline, and 
engine must not be of enough magnitude to -cause hardware damage 
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or major performance degradation; the propellant fill of the ESS 
must be accomplished within the two -hour servicing time set by 
the space shuttle; and a rapid propellant drain is required in the 
event of an emergency condition. 

3. Pressurization and Vent . The propellant tanks must be adequately 
pressurized on the ground to assure ESS structural integrity 
during first stage boost; proper tank pressure at engine start and 
throughout engine burn to assure adequate NPSH must be pro- 
vided; and the tanks must be protected by adequate vent and 
relief capability. 

4. Engine Servicing . Nitrogen purge gas and helium must be 
supplied to the engines at proper conditions and an adequate fuel 
vent must be provided. 

5. Thrust Vector Control . The main engines must be gimballed as 
required by the stability and control analysis and hydraulic fluid 
must be supplied to the engine at proper conditions. 

6. Safing. The main propellant tanks must be safed subsequent to 
main engine burn and residual propellants must be dumped without 
significant mission effect. 

7. Engine Compartment Conditioning. The engine compartment must 
be conditioned and inerted on the launch pad. 

In addition to the specific requirements for each assembly, a number 
of general requirements must be observed. These include: 

1. The main propulsion subsystem must be capable of withstanding 
the predicted environment — acoustic, vibration, and thermal. 

2. Standard operational requirements such as purging, leak checking, 
functional testing, and component replacement will be performed. 

3. The subsystem will be designed to fail operational after the first 
failure of a component and to fail safe for booster crew survival 
after the second failure (FO/FS). This rule is applicable only 
when mated with the shuttle booster and is not applicable to 
structure or pressure vessels. Existing assemblies that are not 
FO/FS will be identified. 

4. The subsystem will provide for safe mission termination. 
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5. The ESS will be controllable (continue to fly safely) with one main 
engine out. 

These requirements are discussed in the description and operations 
section of this report when they have an effect on the ESS main propulsion 
subsystem. 

Subsystem Description 

The main propulsion subsystem is composed of the following significant 
assemblies: 

1. Space shuttle orbiter engines 

2. Propellant feed 

3. Pressurization 

4. Engine servicing 

5. Thrust vector control 

6. Safing 

7. Engine compartment conditioning 

Space Shuttle Orbiter Engines. The basic characteristics of the. space 
shuttle orbiter engine (SSEO) are shown in Table 2-3. The installation of 
the engine is shown in Figure 2-55, the ESS general arrangement drawing. 

The engines are mounted on the Position I-III line on a 114.8-inch 
radius. The mounting on the position line minimizes ESS plume impinge- 
ment on the shuttle booster. The 114. 8-inch radius permits the ESS to 
utilize the same thrust cone as the chemical interorbital shuttle (CIS). The 
CIS has provisions for a seven-foot diameter aft docking adapter for docking 
with the space tug. Therefore, to utilize the same thrust cone the engines 
must be located on a larger radius than they would be if only the ESS needs 
were considered. 

To provide for engine-out control capability, the engines are canted 
at a 12-degree angle to permit the thrust vector to pass as nearly as pos- 
sible through the center of gravity. In addition to the 12 -degree cant, an 
additional 1 -percent precant is provided for thrust structure compliance. 

To minimize aero loads on the engine during first-stage boost, an airstream 
deflector is provided and the engines are toed into a 3.46-degree angle. 
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Table 2-3, Space Shuttle Orbiter Engine Characteristics 


Parameter 

Nozzle Extended 

Nozzle Retracted 

Overall length 

277. 0 +0/-0. 5 in. 

165. 5 ± 0. 250 in. 

Exit diameter 

147. 0 ± 0. 125 in. 

147. 0 ± 0. 125 in. 

Propellant inlet diameter 

15 in. max 

15 in. max 

Gimbal capability 

±7 deg square 

±7 deg square 

Dry weight (excluding insulation) 

8810 lb 

8810 lb 

Burnout weight (excluding insulation) 

9530 lb 

9530 lb 

Mixture ratio capability 

5. 5 to 6. 5 F 

5. 5 to 6. 5 F 

Thrust range capability 

50 to 100 percent 

50 to 100 percent 

Emergency power level 

109 percent at 6. 0 EMR 

109 percent at 6. 0 EMR 

Nominal performance at 6. 0 EMR 



a. Vacuum thrust 

632, 000 lb 

619, 000 lb 

b. Vacuum I 

sp 

■ 459 sec 

447 sec 

c. Sea level thrust 

N/A 

488, 000 lb 

d. Sea level I 

N/A 

352 sec 

sp 







o 

Engine-out capability also dictates a gimbal capability of greater than 
7 degrees for yaw and pitch. This has been provided by orienting the engine 
so that the 10-degree components of the ± 7-degree square pattern are in 
pitch and yaw. 

Propellant Feed. A number of subassemblies are included in the 
propellant feed assembly. In addition to the basic propellant feed these 
include recirculation, valve actuation, pogo suppression, and fill and drain. 

The propellant feed ducts are shown in Figure 2-56. The ESS will 
utilize 13 -inch vacuum jacketed ducts for both the LO^ and feed. With 
the SSEO, the existing (S-II) EH^ tank outlet elbows must be replaced to 
eliminate local cavitation in the elbow. Cavitation would occur in the exist- 
ing elbow because of the high-velocity pressure resulting from the small 
size of the elbow (9. 58 in. ). The high-velocity pressure would drop the 
static pressure in the elbow below the vapor pressure and cavitation would 
result. 

As a result of experience gained on the S-II program, a 90 -degree 
tank outlet elbow configuration has been selected for ease of manufacture. 

A new sump is required on the LO 2 tank to allow for mating with a 13-inch 
prevalve. The space shuttle prevalves will be utilized for ESS prevalves. 

The current planning is to design the shuttle prevalve so that it may be 
actuated either electrically or pneumatically. The ESS will actuate the valve 
pneumatically. A straight run of as much as 56 inches (the exact length 
dependent upon the engine contractor) is required upstream of the engine 
inlet. With the selected ESS configuration, a straight run of approximately 
80 inches results. Four primary propellant depletion sensors will be 
provided in each propellant tank and a two-of-four voting logic provided as 
a backup to the primary velocity cutoff planned for the ESS. In the event of 
an engine-out, different sensors are used for depletion because of the ESS 
tilt angle which results from engine-out. The reason for this procedure may 
be seen in Figure 2-57. By providing different cutoff sensors for the engine- 
out case, the payload loss from increased EO 2 residual with an engine out 
is limited to 1140 pounds. 

Prestart propellant conditioning is accomplished by recirculating 
propellants through the feed ducts and engines and then back to the propellant 
tanks. The recirculation subassemblies are shown on the engine servicing 
design layout (Figure 2-58). Liquid hydrogen recirculation is accomplished 
by electrically motoring the engine LH 2 boost pump prior to engine start. 
This procedure provides the delta pressure necessary for recirculation flow 
through the engine and back to the LHg tank via a manifolded vacuum- 
jacketed return line. A purge line is provided to the return line for system 
purging. Liquid oxygen recirculation flow is accomplished with a natural 
convection system augmented with helium injection. The EO 2 is returned to 
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The propellant feed assembly fail-operational/fail-safe {FO/FS) 
considerations while the ESS and booster are mated are shown in Table 2-4. 
Lines are considered to be "pressure vessels" and exempt from FO/FS 
requirements. No assembly design changes were made as a result of the 
FO/FS requirement. The LO 2 recirculation helium injection system is 
identified as an existing system which does not satisfy FO/FS criteria, in 
accordance with the ground rules of the study control document. 

Pres surization. The ESS main propellant tank pressurization system 
is shown in Figure 2-59. It utilizes the S-II design and components as much 
as possible. The system design requirements to meet the structural and 
engine needs were based on the ESS propellant loads associated with the 
MDAC space station and space tug payloads. The propellant loads corre- 
sponding to these payloads are 450, 000 pounds for the space tug and 
675, 000 pounds for the MDAC space station. 

Because of differences in the launch configurations and associated 
trajectories between the S-II and ESS, structural considerations imposed 
limitations which affected the LHg tank ullage pressure. Table 2-5 is a list 
of pressurization system differences between the S-II and the ESS, The ESS 
LC >2 and LHg vent valves will be interchangeable and will have a high-mode 
band, 27. 5 to 29. 5 psig, and a low mode band, 25. 0 to 27. 0 psig, to meet 
the structural requirements primarily and to avoid the cost of the two-vent- 
valve designs. Meeting the engine inlet requirements is not critical for the 
vent valve bands selected since large margins are available for all 
conditions. 

The loads resulting from the dynamic pressure occurring at 
maximum q require a minimum LH 2 tank pressure of 27. 5 psid. As can be 
seen in Figures 2-60 and 2-6 1 , this situation corresponds to an LH 2 tank 
pressure of approximately 30.6 psia. Figures 2-62 and 2-63 present a 
similar ullage pressure profile for the LO 2 tanks. This condition was 
brought about by employing the S-II pressure switches for controlling pre- 
pressurization. The 34 to 36 psia pressure switch band allows the LO 2 
and LHg tanks to be pressurized with ambient helium. The pressurization 
time is longer for the ESS as compared with the S-II because of the larger 
ullages. For the 675K propellant load, the pre-pressurization times are 
190 seconds for LOg and 110 seconds for LH 2 as compared with 20 and 
60 seconds, respectively.. The pre-pressurization band is high enough to 
permit pressure decay resulting from the cooling of the ullage by the LH 2 
and to assure that tank pressure is within the vent valve band at max Q. 
Figures 2-64 through 2-67 show that this condition is provided for the 450K- 
pound and 675K- pound propellant loading. The earliest venting in the high 
mode for the vent valves would occur at approximately 16 , 000 feet which is 
about 60 seconds after lift-off. This altitude is well above the minimum of 
10, 000 feet considered acceptable for venting. From pre-pressurization 
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Table 2-4. Propellant Feed Assembly Fail- Operational/ 
Fail-Safe Considerations 


Sub as s embly 

Critical to 
Separation 

Remarks and Rationale 

Basic engine 
propellant feed 

Pre valve 
fail-closed 

Failure of a normally open valve which is open 
on the ground and throughout first stage boost to 
the closed position is judged so remote that 
redundancy is not considered necessary. 

Recirculation 

Recirculation, valve 
fail-closed 

Same rationale as for prevalve. 

LiHg recirculation 
motor fails 

Integral part of engine — FO/FS is assumed in 
engine design. 

Helium injection 
supply lost 

Existing system — redesign for FO/FS not 
required. Single low-pressure regulator does 
not meet FO/FS requirements. 

Valve actuation 

None 


Po go suppression 

Accumulator bleed 
fail-closed 

Same rationale as for pre valve. 

Fill and drain 

Fill valve fails 
■ open 

Existing system — redesign for FO/FS not 
required. Same rationale as for prevalve 
(except that valve is normally closed versus 
normally open for prevalve). 




















Q 

Table 2-5. Pres surization Differences Between S-II and ESS 


Item 

S-II Requirement 

ESS Requirement 

Reason for Change 

LH 2 tank vent 

Low-mode crack 

Low -mode (step 

To meet structural require- 

valve 

and reseat. 

vent) crack and 

ments for maximum. 


27. 5 to 29. 5 psig. 

reseat, 25. 0 to 

27. 5 psid in LH 2 tank at end 


High-mode (step 

27. 0 psig. High- 

of -ESS burn. See Fig- 


vent) crack and 

mode crack and 

ures 2-61, 2-63, 2-64, and 


reseat, 30. 5 to 

reseat, 27. 5 to 

2-66. 


33. 0 psig 

29. 5 psig 


LO 2 tank vent 

Crack and reseat. 

Low-mode (step 

Same configuration as LH 2 

valve 

39 to 42 psia 

vent) crack and 

vent valve to minimize costs 



reseat, 25. 0 to 

and ullage mass. No struc- 



27.0 psig. High- 

tural or engine requirement 



mode crack and 

for change. See Figures 2-61, 



reseat, 27. 5 to 
29. 5 psig 

2-63, 2-65, and 2-67. 

Pre- 

20 seconds with 

450K propellant 

Longer pre-pressure times 

pressurization 

ambient helium 

load, 362 seconds 

result from using same pre- 

LH Z tank 

at 0. 8 lb/ sec 

675K propellant 
load, 190 seconds 

pressure system as S-II for 
larger ESS ullages. Helium 
temperature was changed to 



Both with ambient 

ambient for ESS L0 2 tank 



helium' at 

pre-pressure to reduce cost 



0. 8 lb/sec 

and simplify procedure. 
Larger ESS L0 2 tank ullage 

Pre- 

60 seconds with 

450K propellant 

permits change without result- 

pressurization 

cold helium at 

load, 178 seconds 

ing in excessive pressure 

LO 2 tank 

1.6 lb/ sec 

675K propellant 
load, 110 seconds 

decay prior to ESS start. See 
Figures 2-61 through 2-64. 



Both with ambient 
helium at 
0. 8 lb/ sec 


L0 2 tank G0 2 

10 lb/sec G0 2 

7. 66 lb/sec G0 2 

To provide required flow 

flow control 

at 520 R 

at 700 R 

rate to re-pressurize L0 2 

and orifice 



tank to maintain 25. 0 to 
27. 0 psia. 

LH 2 tank GH 2 

4 lb/ sec 

1. 71 lb/sec 

To provide required flow 

flow control 

GH 2 at 200 R 

GH 2 at 530 R 

rate to re-pressurize LH 2 

orifice 



tank to maintain 25. 0 to 
27. 0 psia. 
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Figure 2-61. ESS LH2 Tank Ullage Pressure, 675K Loading 
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Figure 2-63, ESS LO;? Tank Ullage Pressure, 675K Loading 
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Figure 2-64. ESS 450K Propellant Load, LH2 TJ 

During Shuttle Boost 
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Figure 2-65. ESS 450K Propellant Load, L0 2 Ullage Pressure 

During Shuttle Boost 
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Figure 2-66. ESS 675K Propellant Load, LH2 Ullage Pressure 

During Shuttle Boost 





PRESSURE (PSIA) 











& 

until approximately ten seconds after ESS start, the LHg and LO^ vent valves 
will be in the high mode. This condition assures that the tank pressure 

does not exceed 29. 5 psia, which is the maximum allowed because of struc- 
tural loads at separation of the ESS from the shuttle booster (the same as for 
the S-II), and that the minimum ullage pressure will not be less than 
27. 5 psia for ESS start. This assurance will provide an ullage pressure 
margin of approximately 4. 4 and 3. 6 psia for the LH^ and LOg tanks over 
the minimum required. 

The GH 2 pressurizing the LH 2 tank during ESS burn enters the tank at 
530 ± 130 R. The gas continually heats the LH 2 tank forward bulkhead so 
that it is warmest at end of ESS burn. Figure 2-68 shows the predicted bulk- 
head temperatures. Consequently, structural integrity requires that the 
LH 2 tank pressure does not exceed 27. 5 psia at this time. To avoid 
exceeding this pressure and because of the large inlet margins to the engines, 
the vent valves were designed to have a low mode of 25. 0 to 27. 0 psig. Ten 
seconds after ESS start command, the LOg and LH 2 vent valves will be 
commanded to the low mode for the remainder of the burn. 

The LO 2 tank does not have any similar requirements because of its 
being chilled by the LHg tank aft bulkhead (the pressurizing gas enters the 
LC >2 tank at 700 R) and because the LO 2 tank forward bulkhead has a larger 
margin of safety than the LH 2 tank forward bulkhead. Figures 2-69 through 
2-72 present the available NPSP (net positive suction pressure) and margin 
for NPL (normal power level) operation of the engines. Minimum inlet 
pressure margins of 5. 8 and 4. 2 psi for the LH 2 and LO 2 , respectively, are 
shown for the engine start transient. The margin during run at NPL is least 
at cutoff. The following is a comparison of the inlet pressure margin at 
cutoff for NPL (two engines) and EPL (emergency power level) (one engine 
only). 


Inlet Pressure Margin at Cutoff 


Propellant Load 

NPL (two engines) 

EPL (one engine) 

450K LO z 

13 

2. 5 

450K LH 2 

5. 2 

2.8 

675K LO z 

13.4 

3. 0 

675K LH 

5. 0 

2.4 


The S-II flow control orifices will have to be changed to provide the 
flow rates of 1. 71 lb/ sec and 7. 66 lb/sec of GHg and GO 2 for pressurizing 
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Figure 2-69. ESS 450K Propellant Load, LH 2 Engine inlet Conditions 
(Based on Minimum Ullage Pressure) 
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Figure 2-70. ESS 450K Propellant Load, LC>2 Engine Inlet Conditions 
(Based on Minimum Ullage Pressure) 
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Figure 2-71. ESS 675K Propellant Load, LH2 Engine Inlet Conditions 
(Based on Minimum Ullage Pressure) 
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Figure 2-72. ESS 675K Propellant Load, LO2 Engine Inlet Conditions 
(Based oii Minimum Ullage Pressure) 
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the EHg and. EOg tanks, respectively. The total ullage mass for each 
propellant tank and propellant load from pre-pressurization through ESS 
burn is shown in Figures 2-73 and 2-74. 

Evaluation of the pressurization system for its capability of meeting 
the FO/FS requirements during shuttle boost was made. Although the ESS 
main propulsion system will not operate until after separation from the 
booster, loss of the LHg ullage pressure to less than 27. 5 psid at max Q 
could result in LH 2 tank structural failure. Outside of line or fitting failure, 
the primary causes for loss of ullage pressure could occur because a vent 
valve fails open or because the GHg isolation check valve fails open during 
boost. Similar failures in the LO 2 tank pressurization system could result 
in collapse of the common bulkhead. 

A single order failure mode exists in the GOg and GHg pressurization 
lines. If the check valve in the LO 2 line to the engine heat exchanger or the 
isolation check valve in the GH 2 pressurization line should fail open, the 
respective tank ullage pressure would decrease because the ullage gas would 
escape through the engine. This failure mode exists in the S-II and has been 
considered an acceptable risk. The usual check valve failure mode would 
not be in the full-open condition since closing of the check valves is assisted 
by the ullage pressure. The vent valves also present a single order failure 
for both tanks. Although the vent valves are normally closed, a single 
failure could open the vent valve. The failures could reduce the LHg ullage 
pressure below the minimum of 27. 5 psid required at max Q, or if the LO 2 
tank pressure were completely lost, collapse of the common bulkhead could 
occur. The LH 2 and LO 2 pressurization systems are therefore identified, 
in accordance with the study control document ground rules, as existing 
subsystems which do not meet the FO/FS criteria. 

Engine Servicing . Three subassemblies make up the engine servicing 
assembly — the engine helium supply, the engine nitrogen supply, and the 
engine fuel vent. 

Helium must be supplied to the SSEo on the ground, during first stage 
boost and during ESS burn. The helium is required for purging and for 
engine valve actuation if the engine utilizes pneumatic actuation. Based on 
the requirements of the SSEo ICD, a 15 cubic foot supply bottle at 4500 psi 
is needed to provide an adequate helium supply. A flight regulator is used 
to reduce the pressure to the 1600 ± 200 psia specified at the engine connect. 
Because of the large, sudden demands, a 1 500- cubic-inch accumulator is 
required downstream of the regulator. The engine helium supply subassem- 
bly is shown in Figure 2-58. S-II experience indicates that the stipulated 
helium requirement is much larger than should be necessary. Contact with 
all three potential engine contractors points out that a smaller amount of 
helium at lower engine connect pressure will meet engine requirements. 
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Figure 2-73. ESS LHg Tank Ullage Mass Prepressure, 34-36 Psxa 
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The engine nitrogen supply is required for ground purging: the 

subassembly configuration as shown in Figure 2-58 is merely a tubing mani- 
fold from the aft umbilical to each engine- connect panel. 

The engine fuel vent as shown in Figure 2-58 consists of a manifold 
from each engine connect (in order to vent the engine pump seals) to the aft 
umbilical where it is connected to a vent line for ground operations. For 
flight operations, the vent is open at the stage skin, but no flow is antici- 
pated until ESS engine start, at which time the ESS altitude is gr.eat enough 
to preclude any fire hazard. 

The engine servicing assembly FO/FS considerations are shown in 
Table 2-6. As a result of the FO/FS requirement, a check valve will be 
provided in the engine helium supply disconnect and a redundant pressure 
regulator and control valve added in the engine helium supply subassembly. 


Table 2-6. Engine Servicing Assembly Fail-Operational/ Fail-Safe 

Considerations 


Subassembly 

Critical to 
Separation 

Remarks and Rationale 

Engine helium 
supply 

Supply 
control 
valves fail 
open 

Redundant control valve supplied in 
disconnect (F/O). Assumes that the 
engine will start with loss of supply in 
flight {F /S). 

Regulator 
fails (open 
or closed) 

Redundant regulator and control valve 
supplied (F/O). Assumes that engine 
will start with loss of supply in 
flight (F/S). 

Dump valve 
fails open 

Failure of normally closed valve to 
energized position is judged so remote 
as not to require redundancy. 

Engine nitrogen 
supply 

None 


Engine fuel vent 

None 
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Thrust Vector Control. An independent hydraulic system, essentially 
conforming to MIL-H-25475-type II, will be installed at each orbiter engine 
position. The systems will provide the forces to position and gimbal the 
engines in response to the vehicle flight control commands. 

Each system will employ two linear-acting actuators to gimbal the 
engine about each of two nearly-perpendicular axes. Each actuator will be 
capable of deflecting the engine through the maximum rated gimbal angle 
(±7 degrees). The gimbal axes will be oriented so that they nominally bisect 
the vehicle pitch and yaw axes. Therefore, pitch, yaw, and roll deflections 
will be achieved by the combined motion of the two actuators. The actuator 
orientation is chosen to provide the largest possible engine deflection in the 
pitch and yaw planes (approximately 10 degrees). The actuator orientations 
are shown on Figure 2-75. The angular excursions shown on the drawing 
are slightly larger than the capability of the actuator to allow for snubbing, 
overtravel, and misalignment. 

With the actuators at hull, the engines will be aligned to point each 
thrust vector toward the vehicle's nominal center-of-gravity. The alignment 
results in the engines being canted radially outboard by 12 degrees when at 
full thrust and 13 degrees at zero-thrust. The result creates wasted thrust 
components normal to the line -of -flight; therefore, to reduce the losses and 
resultant payload penalty, the flight control system will apply 6-degree 
inboard commands to position the thrust vectors more nearly parallel to the 
line -of -flight. The flight control system will sense if only one engine of a 
pair is firing and will remove the bias commands: it thus causes the thrust 
vector of the firing engine to point toward the nominal center of gravity. The 
biased commands will not be applied until the engine start transients have 
subsided and will be removed shortly before engine shutdown. 

NASA is currently evaluating the potential addition of an engine driven 
accessory pad to the space shuttle engine. If approved, the ICD would be 
changed accordingly. The contractor has assumed that this capability will be 
provided and has described a hydraulic system based on this assumption. In 
the event that this capability is not provided, the type of system selected 
would be a pneumatically driven hydraulic system. 

A simplified schematic of the system to be used for the orbiter engine 
is shown on Figure 2-75. Each engine system will have identical engine- 
driven pumps, servo actuators, accumulator/ res ervoir/manifold assemblies 
(ARMA's), and electric motor-driven auxiliary pumps. 
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The following are descriptions of the hydraulic system components: 


Actuators. Figure 2-76 is a schematic of the S-II servo actuator, 
which is quite similar to the one which will be used on the ESS. The signifi- 
cant components and features of the actuator are the following: 

1. An integral servo valve with mechanical feedback of piston 
position 

2. A dynamic pressure feedback (to attenuate load resonance) 

3. A complete filtration of all incoming fluid with additional filtration 
for servo valve first- stage flow 

4. A pre-filtration valve and a bleed valve for flushing and bleeding 

5. A hydraulic lock valve to restrain piston motion in the absence of 
applied hydraulic power 

6. Redundant seals on piston rod 

7. A cylinder bypass valve to make possible manual positioning of the 
actuator {the solenoid operator, as shown for S-II, was required 
because of the J-2 engine-start characteristics in static firing; 
the need for this feature on ESS has not yet been established) . 

The S-II actuator has no redundant features other than piston position 
potentiometers and rod seals. It is proposed that the ESS actuators should 
have three servo valve first stages arranged in parallel to produce a major- 
ity voting system such as was developed for (but never implemented on) the 
Saturn S-IVB actuator. This arrangement does not rigorously provide fail- 
operational/fail-safe (FO-FS) capability with respect to the actuator but 
does allow operation after one failure (or after two failures in some 
instances) of the weakest elements in the actuator. It should be noted here, 
however, that overall FO/FS (or operational) is achieved for many failure 
cases by virtue of two engines (and associated independent TVC systems), in 
conjunction with the capability of completing the mission with one engine out. 

The preceding paragraph describes what are currently judged to be 
typical actuators for the ESS. It is possible, however, that the actuators 
which will be developed for the orbiter, or booster, will be directly applica- 
ble to the ESS; if applicable, they will be used. 

Actuator sizing will depend on final selection of the engine since each 
of the proposed engines has different actuator moment arms. 
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Figure 2-76. Typical Servoactuator 
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Engine -Driven Pump . The engine-driven pump will be similar to the 
S-II/J-2 engine-driven pump shown in Figure 2-77. The required pump 
capacity is approximately 25 gpm. This flow rate must be obtainable at the 
minimum pump speed (TED) consistent with the minimum thrust level 
utilized. 

The pump shown in the figure is of the variable -delivery, constant- 
pressure (adjustable) type, such as is commonly used in commercial and 
military aircraft. Shown in the figure, but not required for ESS, are the 
solenoid valve, filter, and orifice arrangement. 

Figure 2-76 shows a normally closed solenoid valve interconnecting 
the pump inlet and outlet ports. The function of this valve would be to mini- 
mize the torque applied to the turbine during engine start if required on the 
selected engine. If not required, the valve will be deleted. 

Electric-Driven Pump . An electric-driven pump will be provided to 
accomplish ground checkout and to provide hydraulic power for the engine 
control system if required by the engine. If hydraulic power is not required,- 
the pump motor will be ground-powered only. 

The pump elements will be similar to those of the engine-driven pump 
previously discussed but will not incorporate the thermal barrier or 
provisions for thermal control bypass. Also, it is probable that the case 
drain will be routed back to the reservoir instead of to the pump inlet as 
shown in the figure. 

Accumulator/ Reservoir/Manifold Assembly (ARMA), The ARM A will 
be similar to that of the S-II which is shown in Figure 2-78. The basic func- 
tions of this unit are to provide as follows: 

1. Storage of high-pressure fluid in order to supply short-term 
demands in excess of pump capability (including the time during 
the engine start before the main pump is up to speed) 

2. Damping for hydraulic transients 

3. A low-pressure reservoir in order to make up for external leak- 
age, thermal contraction, and the volume accepted or discharged 
from the accumulator 

4. Overpressure relief 

5. Filtration of all incoming and outgoing fluid 
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Figure 2-78. Typical Accumulator, Reservoir Manifold Assembly (ARMA) 
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Proper inlet pressure for the pumps 

7. A means connecting to external hydraulic power for servicing and 
checkout 

Additional analysis of the transient hydraulic demands during the 
engine start sequence (and the engine nozzle extension if applicable) will be 
required to establish the accumulator requirements. The accumulator size 
will, in turn, partially govern the reservoir size. However, to judge from 
a cursory evaluation — the accumulator, reservoir, and gas charge volumes 
for a system which does not have to supply the engine with hydraulic fluid 
will be approximately as follows: 


Item 

Volume (cu. in. ) 

Reservoir 

300 

Accumulator oil 

100 

Gas charge 

300 


Safing. After the velocity cutoff of the ESS, the residual propellants 
in the main tanks will be dumped through the engines, and the tank will be 
safed. 


The propellant dump is required only if engines are to be recovered in 
orbit. If engines are not recovered, tank safing by venting will be accom- 
plished immediately after main stage cutoff. 

Propellant dump is accomplished by opening the engine propellant 
valves. The result is a propulsive force applied to the ESS. The propellants 
are not dumped simultaneously — a precaution to eliminate any safety hazard. 
The planned sequence is to dump L0 2 first, hold for five minutes following 
the completion of the L0 2 pump, and then to initiate the LH2 dump. 

The amount of propellant remaining depends upon the mission, whether 
propellant ballast is used because of load considerations, and the flight 
performance reserves used to meet the required performance. Dumping the 
propellant residuals through the engines produces propulsive thrust during 
the coast period which will affect the nominal 66 x 100-nm orbit. 

In order to determine the effect of dumping the propellants, a brief 
performance analysis was conducted for two configurations. The first con- 
figuration had only the propellant and reserves required to perform the 
mission, and the second had additional propellant loaded as ballast. 
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Each configuration was analyzed for the minimum and maximum pro- 
pellant residual cases. The configurations were first checked 
to determine the maximum effect of dumping by assuming the total propellant 
was dumped in the posigrade direction. The propellant dump conditions 
considered for this analysis are presented in Table 2-7. 

Case 1A, which has nominal propellant loading and minimum residuals, 
dumps a total of 6700 pounds of propellant in a period of 656 seconds after 
main stage cutoff. With a posigrade propellant dump, the orbit was changed 
so that the apogee increased from 100 nm to 115 nm. If the orbit is circu- 
larized when the vehicle reaches an altitude of 100 nm {1700 seconds), a AV 
of 165 fps is required as compared with 63 fps for the nominal case with no 
propellant dump (66 x 100 nm-orbit). If the orbit is circularized at 115 nm, 
the AV required is 88 fps. 

Case IB, which has nominal loading and maximum residuals, dumps 
19, 500 pounds of residual propellant in a period of 1227 seconds. In this 
case, the apogee is increased from 100 nm to 135 nm, and a AV of 237 fps is 
required to circularize the orbit when an altitude of 100 nm is attained. If 
the orbit is circularized at 135 nm the AV required is 120 ft. / sec. In 
Case IB as in Case 1A, the propellant dump has been completed before the 
vehicle reaches apogee. 

For Cases 1A and IB, it is felt that if the propellant dump can be 
predicted fairly accurately, then the effect of dumping can be minimized by 
dumping during part of the coast in the posigrade direction and part in the 
retrograde direction. Another way to minimize dumping effects would be to 
change the boost phase performance to compensate for the effects of propel- 
lant dumping. However, if the propellant dump cannot be predicted 
accurately enough, then posigrade dumping can be used; in this case either 
the higher AV's just quoted will be required or circularization at a higher 
orbit can be considered. 

Configuration 2 has considerably more propellant residuals and, 
consequently, has a much greater effect on the coast orbit. For example, 
Case 2A which has additional propellant for ballast dumps 58, 000 pounds in 
a period of 3800 seconds. If the propellant is all dumped in the posigrade 
direction for this case, the altitude has exceeded 175 nm by the time all the 
propellant has been dumped. Also, the perigee exceeds 100 nm,' and no 
second opportunity to circularize at 100 nm occurs. Similarly, for Case 2B, 
a propellant residual of 71, 000 pounds is dumped in a period of 4383 seconds, 
and the deviation from the nominal orbit is even greater. Since dumping 
continues long after the distance of 100 nm is attained, if the orbit is 
circularized at 100 nm, the circular orbit will then be affected by the 
remainder of the propellant dump. 
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Table 2-7. Propellant Dump Conditions 


Condition 

Amount 

Dumped 

(lb) 

Thrust 

During 

Dump* 

(lb) 

1 f 

sp of 
Dump* 
(sec) 

Time 

to 

Dump 

(sec) 

I 

(lb/sec) 

Proposed 
Sequence of 
Dump 

Case 1. No propellant ballast 







A, Residuals only 







L° 2 

3000 

720 

30 

125 

90, 000 

L0 2 first, hold 

LHo 

3700 

480 

30 

23 1 

111, 000 

5 min, then 







dump LH2 and 

Z least condition 

6700 



356 

201, 000 

safe. 

B. Residuals + 2 (FPR) 







L°2 

14, 000 

720 

30 

583 

420, 000 

LO2 first, hold 

LHo 

5500 

480 

30 

344 

165, 000 

5 min, then 

Lj 






dump LH 2 and 

Z maximum condition 

19, 500 



927 

585, 000 

safe. 

Case 2, Propellant ballast 







A. Residual + ballast 







lo 2 

6000 

720 

30 

250 

180, 000 

Li 0 2 first, hold 

LHo 

52,000 

480 

30 

3250 

1, 560, 000 

5 min, then 

M 






dump LH 2 and 

Z least condition 

58, 000 



3500 

1, 740, 000 

safe. 

B, Residual + ballast 







+ 2 (FPR) , 







lo 2 

17, 000 

720 

30 

708 

510, 000 

L0 2 first, hold 

lh 2 

54, 000 

480 

30 

3375 

1, 620, 000 

5 min, then dump 

Z maximum condition 




4083 

2, 130, 000 

LH 2 and safe. 

^Accurate to ±20% 







It is desirable to keep propellant residuals below the amount that can 
be dumped before apogee of the coasting orbit is achieved. The current load 
trajectories for all three missions do not use propellant as ballast. Conse- 
quently, the propellant residual is considerably less than in Cases 2A and 
2B, and propellant dumping will be completed before the apogee of the 
coasting orbit is achieved. 

Subsequent to the propellant dump, the main propellant tanks will be 
safed by actuating redundant (in parallel) ordnance vent valves mounted on 
each propellant tank. A nonpropulsive manifold is provided for each tank 
safing vent. 

The safing assembly FO/FS considerations are shown in Table 2-8. 

No design changes were made to the safing system as a result of the FO/FS 
evaluation. 

Engine Compartment Conditioning. The engine compartment condi- 
tioning assembly is utilized for purging the aft boattail. The purge conditions 
and inerts the aft boattail with GNg prior to launch. Air is used for 
conditioning until the start of loading. The assembly is shown in Fig- 
ure 2-79. A thermal control purge is also provided to the electrical 
containers in both the forward and aft skirts. Like the engine compartment 
purge, both air and GN£ are used. 


Table 2-8. Safing Assembly FO/FS Considerations 


Subas s embly 

Critical to 
Separation 

Remarks and Rationale 

Propellant dump 

None 

Only critical to engine recovery. 

Safing vent 

V ent fails 
open 

Open failure of normally closed 
ordnance valve judged so remote 
as not to require redundancy. 
Existing system. 

V ent fail s 
closed 

Not critical to separation but is 
critical to rendezvous operations 
with orbiter. If first vent fails, 
redundant vent is provided (F/O). 
If second vent fails, normal tank 
relief will protect tank (F/S). 
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Subsystem Operation 

The main propulsion subsystem (MPS) operation is shown by 
Figure 2-80 which depicts the major MPS events from the initiation of launch 
countdown at lift-off minus 2 .hours to the completion of propellant dump and 
safing; after this time the MPS is not active. Figure 2-80 is based upon a 
MDAC space station payload. For other payloads the propellant loading will 
vary so that fill time, prepressurization time, engine burn time, etc. , will 
change accordingly. 

The main propulsion system operation is essentially the same as for 
S-II with the following exceptions: 

1. Pad servicing time for launch has been reduced to two hours to be 
consistent with the space shuttle program. 

2. The engines are toed in to a 3. 46 -degree angle from the normal 
13-degree cant angle during first stage boost, returned to a 
13-degree angle for ESS engine start, and then toed in to a 
6-degree cant for mainstage operation. 

3. The engine nozzle is’ extended prior to engine start and retracted 
after cutoff. 

4. The auxiliary hydraulic pump operates in flight (as well as on the 
ground) to provide hydraulic fluid to the engine. 

5. LH 2 recirculation is accomplished by electrically motoring the 
engine LHg boost pump. 

All other operational changes are minor and are dictated by configura- 
tion changes because of the employment of a different type of engine and the 
number of engines. 

MPS Engine Removal 

Subsequent to ESS separation from the payload, the MPS engines will 
be recovered by using a space shuttle orbiter. The recovery will be accom- 
plished within the 24-hour service life of the ESS. 

In order to perform the on-orbit removal of the ESS main engines. The 
ESS/engine connects had to be designed so that they are easily separated. 

This has been accomplished as shown by the engine connect layout, 

Figure 2-81. Separable nuts are used to effect the separation. The basic 
sequence of events for engine recovery are orbiter/ESS docking, ESS engine 
separation, engine stowage and orbiter/ESS separation. 
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Figure 2-80. ESS Main Propulsion System Operating (Sheet 1 of 2) 
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Figure 2-80, ESS Main Propulsion System Operating (Sheet 2 of 2} 
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The space shuttle orbiter performs the rendezvous and docking 
maneuvers for orbiter/ESS docking. During the docking maneuver, the ESS 
will maintain attitude. A docking port is provided on the ESS at Position III. 
The port has the same dimensions as the port on the space station so that the 
orbiter-to-space-station adaptei' can be used for orbiter/ESS docking. The 
same sequence as is used for the orbiter/ space station docking will be 
employed for the orbiter/ESS docking. The docking is shown in Figure 2-82. 
The sequence of docking is as follows: 

1. Space Shuttle Orbiter performs near rendezvous with the ESS, 
the ESS maintains attitude. 

2. A majority of the separable nuts connecting the engines to the ESS 
are actuated. The engine fluid connect, electrical connect, pro- 
pellant feed ducts, hydraulic actuators, and heat shield are 
separated; separation is verified. Figure 2-81 shows the engine 
connect details. 

3. The cargo doors of the orbiter are opened. 

4. The docking adapter is removed from the orbiter carbo bay by 
using the orbiter manipulator arms. The manipulator arms are 
part of the baseline shuttle orbiter and are operated by the orbiter 
crew. 

5. The docking adapter is connected to the ESS docking port. 

6. The manipulator arms pull the ESS and orbiter together until the 
docking adapter mates with the orbiter. The vehicles are now 
hard-docked and attitude control will be maintained by the orbiter. 

7. The manipulator arms tool is changed, and the arms are attached 
to the ESS engine after the heat shield has been partially removed 
as required for access. To attach to the engine, an attaching 
point on the engine is required. No attaching point is presently 
specified in the engine I CD. Figures 2-83 and 2-84 show proposed 
attaching points. Figure 2-83 shows the attaching point on the 
engine powerhead; Figure 2-84 shows a cantilevered bracket which 
puts the handling point over the engine center of gravity. Either 
point is acceptable for orbital recovery (zero g) of the engine but, 
since it is also necessary to handle the engine in earth gravity, 

a handling point over the center of gravity is preferable. The 
manipulator arm tool for engine attachment is shown in Fig- 
ures 2-83 and 2-84, also. 

8. The separable nuts holding the engine gimbal block are actuated. 
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Figure 2-82. Operational Sequence for ESS Docking 
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Figure 2-83* Proposed Attachment of Manipulator Arm to Orbiter Engine 
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The engine is now separated from the ESS and is held by the 
manipulator" arms . The engine recovery operation is completed as follows: 

1. The engine is placed in the orbiter cargo bay. Figure 2-85 
pictures an SSEo vertical in the orbiter cargo bay. As can be 
seen, an interference results. Therefore, the SSEo will be stowed 
horizontally (Figure 2-86). A storage rack will be provided. 

2. The manipulator arms tool is changed and the arms are attached 
to the docking adapter. 

3. The ESS and orbiter are separated. The ESS will now once again 
provide its own attitude control. 

4. The docking adapter is placed in the orbiter cargo bay, the 
manipulator arms are stowed, and the orbiter cargo bay doors are 
closed. 

The engine recovery operation is now complete except for orbiter 
return utilizing the standard space shuttle orbiter flyback. Figure 2-87 
shows the proposed recoverable hardware. The orientation shown in 
zones 11 through 15 of sheet 2 is the selected recovery mode. As can be 
seen, the existing shuttle orbiter manipulator arms (600-inch) are satis- 
factory for the recovery operation; more than 27 feet of the orbiter cargo 
bay is available for other shuttle cargo after the engines and docking adapter 
are stowed. (For details on avionics recovery, refer to Section 2.3. 8 of 
this report. Avionics recovery is accomplished at the same time as engine 
recovery. ) 

Air Loads on ESS Engines During Boost 

The two main propulsion engines on the ESS configuration are carried 
with nozzle extensions in retracted position during boost. In addition, the 
nozzles are protected from impingement by airstream deflectors which 
extend 71 inches aft of the base plane with a flare angle of 15 degrees. 

(Figure 2-88). 

An analysis has been made to predict the occurrence or nonoccurrence 
of impingement during boost and-'to estimate the magnitudes of nozzle forces 
and moments about the gimbal point. 

The amount of nozzle surface exposed to impingement depends upon 
vehicle angle of attack and the detailed geometry of the airstream deflectors 
and nozzle. The magnitude of the pressure loads will be affected by the 
turning angles associated with separation and reattachment of the flow. An 
analytical method has been developed by which numerical estimates of nozzle 
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Figure 2-85. ESS Orbiter Engines Stored Vertical 
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loads and moments can be calculated for engine configurations with 
airstream deflectors of the type described. The principal restriction is that 
vehicle angle of attack and engine deflection angle must lie in the same 
plane (the pitch plane). 

The base pressure and the Mach number of the separated flow are 
computed from the Prandtl-Meyer expansion associated with the turning 
angle cf> (Figure 2-89). The turning angle is evaluated as a function of free- 
stream Mach number. The differential pressure acting over the impinge- 
ment zone is evaluated in terms of a pressure coefficient based on linearized 
theory, as follows: 


c = P i ~ F b = 2(X + e ) 

P - 1 

Here the angle ( X+0 ) is the turning angle of reattachment expressed in 
radians, and Fj is the absolute pressure after impingement. 

The same procedure was applied to the prediction of loads on the ESS 
nozzles in the retracted position. The results for a representative boost 
trajectory are listed in Table 2-9. 

The potential engine contractors indicated that a maximum engine 
nozzle force of 300 pounds is an acceptable limit without redesign. To 
alleviate any design changes, three configurational changes have been con- 
sidered which would prevent any aerodynamic impingement: 

1. Extending the length of the airstream deflector 23. 3 inches, 
keeping the flare angle constant at 15 degrees. 

2. Terminating the airstream deflector at the same axial station but 
increasing the flare angle to 23. 7 degrees. 

3. "Toeing-in" the engines to a 3. 46 -degree angle to the centerline. 

Item 3 was selected because of the minimum impact on the proposed 
ESS vehicle. The "toe-in" of engines would be accomplished by an electrical 
signal prior to lift-off. 
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Table 2-9. Impingement Loads and Moments for the ESS Nozzle 



Trajectory Time 
(sec) 

Loads 

80 

90 

100 

110 

130 

150 

o 

o 

2 

1. 372 

1. 773 

2. 216 

2. 666 

3. 771 

5. 000 

q as <p sf) 

649. 2 

660. 4 

582. 6 

463. 3 

277. 9 

153. 1 

<* (deg) 

0 

0. 125 

0. 25 

0. 375 

0. 5833 

0. 75 

P I " P B 

2. 758 

1. 818 

1. 083 

0. 600 

0. 162 

0. 0437 

S (in. ) 

6.76 

14. 29 

18. 69 

21. 08 

23. 75 

23. 69 

F n (lb -ft) 

489. 0 

1050. 0 

973. 0 

660. 0 

219. 0 

58. 8 

M (in. -lb -ft) 
G 

75. 7 

3 

x 10 

159.3 
x 10 3 

145. 9 

3 

x 10 

98. 4 
x 10 3 

32. 4 
x 10 3 

8. 7 

3 

x 10 













The integrated pressure force acting on the nozzle in a direction 
perpendicular to the axis and the corresponding moment about the gimbal 
plane have been found to be 




(tan 0 + tan X) 


S 


3/2 


and 




respectively. 


The equations have been verified by applying them to S-IC model test 
data. The moments were found to agree well with model test data over the 
Mach number range 1.6 to 2. 4 and for angles of attack as great as 
10 degrees. 

2. 2. 2 Auxiliary Propulsion Subsystem (APS) 


The auxiliary propulsion subsystem is divided into two basic 
elements — orbit maneuvering and attitude control. Two 10, 000-pound thrust 
hydrogen/oxygen engines are utilized for orbit maneuvering. The engines 
will be developed for the space shuttle orbiter. Attitude control is accom- 
plished with 14 2100-lb thrust hydrogen/oxygen thrusters. The thrusters 
will be developed for the space shuttle orbiter and booster. The two ele- 
ments are integrated in that they have common propellant tankage and 
pumps. The auxiliary propulsion subsystem is shown schematically in 
Figure 2-90. 

Attitude Control Propulsion Subsystem (ACPS) 

ACPS Design Requirements. The design requirements for the ACPS 
are set primarily by flight stability and control requirements. The basic 
requirements may be summarized as follows: 

1. The subsystem must provide pitch, yaw, and roll attitude control 
during the 24 hour ESS on-orbit service life. Initial estimates 
indicate that 300, 000 pound-seconds of impulse are required. 

2. The subsystem must provide roll control in the event of a one 
main engine or OMS engine out and flight control for a one OMS 
engine out condition during deorbit. It is this requirement that 
dictates a total of eight roll control nozzles. 
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3. The subsystem is to provide translation thrust during rendezvous. 
A delta velocity of 24 feet per second (braking) is necessary. 

4. The system must be designed to meet fail-operational/fail- safe 
criteria since attitude control is required when the shuttle orbiter 
is docking with the ESS. 

ACPS General Description . The ACPS utilizes a total of 14 thrusters 
to fulfill its design requirements. The thrusters are mounted seven at each 
position (I and III). The exact mounting locations are shown by Figure 2-91. 
The thrusters perform the following primary functions: 

1. Eight thrusters provide roll and pitch control: thrusters 1, 2, 4, 
and 7 at Position I and 8, 9, II, and 14 at Position III. 

2. Two thrusters provide yaw control: thruster 5 at Position I and 
thruster 12 at Position III. 

3. Two thrusters provide braking thrust: thruster 3 at Position I and 
thruster 10 at Position III. 

4. Two thrusters provide longitudinal translation: thruster 6 at 
Position I and thruster 13 at Position III. 

The thrusters are mounted under the main engine LH 2 feed line 
fairing. The thruster exit planes are essentially flush with the fairing for 
those thrusters located aft of the feed line. Thruster skirt extensions will 
be provided wherever needed. However, the braking thrusters (3 and 10), 
which have the exit forward, must be completely covered during first-stage 
boost. A thruster door, which will be opened once the ESS is on orbit, is 
provided, therefore. The door will be designed so that, if it does not actu- 
ate open when commanded, the exhaust from the thruster will open the door. 

The 2100-pound thrust shuttle attitude control thrusters were selected 
for ESS because of the large thrust required for roll control when one main 
engine is out. 

The characteristics of the thrusters are shown in Table 2-10. The 
overall subsystem performance differs from the basic thruster performance 
because it includes the propellant for the gas generators which drive the 
pumps and condition the propellants for ACPS use. The thrusters burn 
high-pressure gaseous oxygen and hydrogen while the propellant is stored as 
liquid at low pressure. Factoring in the GG propellant causes the system 
specific impulse and mixture ratio to be lower than the basic thruster 
values . 
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the LOg tank via separate uninsulated return lines. Shutoff valves are 
provided at the propellant tanks in both the LOg and LHg recirculation return 
lines to provide emergency tank isolation. The S-II recirculation valves will 
be used for this application. LHg recirculation will be initiated approxi- 
mately ten minutes prior to engine start; LOg recirculation commences with 
LOg tanking. Helium injection to augment LOg recirculation begins 
30 minutes prior to liftoff. 

Valve actuation is required for actuating the propellant valves for 
such ground operations as checkout and purging, and in flight for providing 
tank isolation and a propellant dump. All the stage propellant valves are 
pneumatically actuated, and the actuation pressure is supplied by a stage 
helium bottle and regulator. The valve actuation subassembly is shown in 
Figure 2-59, the pressurization layout. 

Pogo- suppression is provided by supplying accumulators at the engine 
L,Og pump inlets. The accumulator decouples the feedline and limits the 
interaction of structure, feedline, and engine. Based on the assumption 
that the ESS structural modes are about the same as on the S-II 
(6 to 10 Hz), a preliminary analysis indicates that a 430- cubic-inch accumu- 
lator at the LOg pump inlet will minimize pogo susceptibility by reducing the 
first feedline mode to a point below 6 Hz. It is felt that the probability of a 
local high gain mode similar to the 16-Hz oscillations that occurred on S-II 
is quite small because of the absence of the center engine beam. The pro- 
posed accumulator is shown in Figure 2-56 along with growth potential to 
increase the accumulator size to 600 cubic inches if subsequent analysis 
shows this to be necessary. The accumulator size cannot be considered 
definite because of the preliminary nature of the ESS design, but it may be 
concluded that pogo susceptibility may be eliminated by installing feedline 
accumulators which will be filled from the same helium supply employed for 
LO 2 recirculation helium injection and bled through the LOg recirculation 
return lines. No analysis was attempted of pogo on the hydrogen side, the 
decision based primarily on the fact that pogo has never been a problem 
with LHg, Farther, ESS pogo analysis will be accomplished by Task 
Authorization 13, Change Order 2026 to Contract NAS7-200. 

Main propellant tank fill and drain will be accomplished by utilizing 
the S-II fill and drain subassembly. Since the subassembly is essentially 
identical with the S-II subassembly, no layout has been made. The capability 
of the fill and drain is such that with the maximum planned ESS loading the 
tanks can be filled within the required two-hour servicing time. The 
fill will be controlled by the tank capacitance probes, with point sensors as 
backup. Some new point sensors will be required because of the different 
propellant loadings. The tanks can be drained in 30 minutes with the 
maximum propellant load. 
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Table 2-10. ACPS Thruster Characteristics 


Parameter 

Basic Thruster 

Subsystem 

1 . 

Thrust 

2100 lb 

2100 lb 

2. 

Mixture ratio, O/F 

4 to 1 

3 to 1 

3. 

Specific impulse 

425 sec 

370 sec 

4. 

Chamber pressure 

300 psia 

300 psia 

5. 

Expansion ratio 

20 

N/A 

6. 

Exit diameter 

1 1 . 4 in. 

N/A 

7. 

Overall length 

26 in. 

N/A 

8. 

Weight ■ 

44 lb 

N/A 

9. 

Propellant inlet diameter 

1 in. 

N/A 

10. 

Minimum impulse bit 

/ 

210 lb-sec 

210 lb-sec 


To minimize heating of the ESS skin, the thrusters are mounted at a 
20-degree angle. Propellant for the ACPS is stored in the same tanks as is 
the orbit maneuvering subsystem propellant. The discussion of the ACPS 
propellant budgeting is included in the OMS discussion. 

A fail-operational/fail-safe (FO/FS) analysis was made of the ACPS. 
The results are documented in Table 2-11. The subsystem has been 
designed to FO/FS criteria with one exception. This provision is due to 
having only two turbo pump and gas generator packages when actually three 
are required to meet the FO/FS standard. For a discussion of the rationale 
for not meeting the FO/FS standard completely, refer to the orbit maneu- 
vering subsystem. For engine-out conditions, the FO/FS considerations 
are: 

1. One main engine out . For an engine-out condition, the engine loss 
is the first failure. The vehicle remains operational as the four 
ACPS thrusters available for roll control provide complete con- 
trol. If a roll thruster goes out the vehicle is still safe because 
the effect will be for the vehicle to roll a few degrees and then 
roll back. 
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Table 2-11. ACPS Fail-Operational/ Fail-Safe Considerations 


Failure 


Pitch/roll thrusters 
(1, 2. 4, 7, 8, 9. 

11, and 14) 


Remarks and Rationale 


Four thrusters are provided for pitch/roll in each direction. 
Two thrusters will provide adequate control. 


Yaw thruster 
(5 and 12) 


If thruster fails, use braking thruster for yaw (FO). If 
braking thruster fails, roll vehicle and use pitch 
thruster (FS). 


Braking thruster 
<3 and 10) 


Translation thruster 
(6 and 13) 


If first thruster fails, one braking thruster will provide 
adequate braking. If second thruster fails, stage can be 
rotated and OMS or translation thrusters can be used to 
provide fail-safe mode. 

If first thruster fails, one translation thruster is adequate 
(FO). If second thruster fails, rotate stage and use braking 
thrusters. 


Thruster manifold 
inlet regulator 


Accumulator fill 
check valve 


After regulator fails, the manifold inlet valve is closed. If 
operational valve fails, a redundant valve is provided (FO). 
Thrusters are manifolded so that the backup thrusters and 
the primary thruster are on different manifolds. 

If first check valve fails, a redundant check valve is pro- 
vided. If second check valve fails, disconnect provides 
shutoff (FO). 


Accumulator relief 
valve 


Thermal conditioning 
gas generator (GG) 


When the primary relief valve fails, switch to backup relief 
(FO). If the second failure is a primary relief isolation, a 
redundant isolation is provided. If the second failure is a 
backup relief or its isolation valve, a burst diaphragm and 
relief valve are provided and the system is still operational. 

If first GG fails, a second GG maintains the system opera- 
tional (two complete pump and GG sets are provided). If 
first failure is GOX- conditioning GG and second is GH 2 - 
conditioning GG (or vice versa), system is still operational. 
If both GOX- conditioning GG's or both GH 2 -conditioning GG's 
fail, the ACPS is inoperative. This condition does not meet 
FO/FS requirements since attitude control is required for 


fail-safe. 


Gas generator inlet 
valves, regulators, 
select valves, 
check valves 


Pumps, pump drive 
GG's, etc. 


The various system valves are installed (with applicable 
redundancy) as required to support the thermal conditioning 
GG's. For this analysis, they may be considered a part of 
the GG's, and the same considerations apply. For instance, 
if the oxygen inlet valve to both GH 2 conditioning GG's fails, 
the system is inoperative. 

Refer to orbit maneuvering subsystem FO/FS considerations. 
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2. One orb it -maneuvering engine out. With an OMS 

(orbit-maneuvering subsystem) engine out, two roll control 
thrusters are required for the most severe case (deorbit). Full 
redundancy is available since there are four thrusters for roll 
control. 

ACPS Operation . The attitude control propulsion subsystem for the 
ESS will operate essentially the same as the space shuttle attitude control 
propulsion subsystem. 

Prior to lift-off, liquid propellants are contained in the auxiliary 
propulsion subsystem tanks and the ACPS accumulators are charged with 
GOX and GH 2 , which also pressurizes the propellant tanks. 

The attitude- control thrusters burn gas from the accumulators. 
Redundant spark plugs provide ignition. The accumulators are initially 
pressurized to 1000 psi. As the thrusters burn gas from the accumulators, 
the accumulator pressure decreases until a pressure switch drops out sig- 
naling the pumps to start to recharge the accumulators. A typical accumu- 
lator recharge is shown in Figure 2-92. When the accumulators are being 
charged, all eight gas generators shown in Figure 2-90 are operative. Four 
of the gas generators drive the turbo pumps and four provide hot gas to the 
heat exchangers which condition the propellants from the pump discharge 
prior to pressurization of the accumulators. The exhaust gas from the heat 
exchangers and pump turbines is vented overboard via a nonpropulsive vent 
valve. The three -position valve downstream of each pump is placed so that 
the pump discharge flow is passed through the heat exchangers — not to the 
OMS thrust chamber. The APS propellant tank pressure is maintained, 
while the pumps are running, by gas from the accumulators. 

The thrusters are capable of operating in any combination commanded 
by the GN&cC. The gas accumulators are sized by two considerations — 
capability of maintaining the thrusters in continuous operation (if required) 
and of restricting the number of pressure cycles on the accumulators to 
less than 100. For a one main-engine out condition, four thrusters will be 
operated continuously, and it is this condition which sizes the accumulators. 
Two GOX accumulators of 13 cubic feet each and two GH 2 accumulators of 
68 cubic feet each are used. 

The attitude control propulsion subsystem is active for the total time 
the ESS is on-orbit in order to maintain attitude (pulse mode), except when 
the OMS engines are burning. The subsystem is also active in providing 
roll control, with a main or OMS engine out, and for braking during rendez- 
vous (continuous mode). 
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Orbit-Maneuvering Subsystem (OMS) 

QMS Design Requirements . The preliminary design requirements for 
the OMS are set by the design reference mission. The OMS must provide 
the velocity increments to change orbits, to rendezvous if required, and to 
deorbit. The detailed orbit maneuvers are presented in the mission time- 
line. The basic requirements may be summarized as follows: 

1. The subsystem must provide controlled velocity increments to 
perform orbit maneuvers totaling 621 fps while the ESS and pay- 
load are mated. Additional Avelocity may be required as a result 
of propellant dump. 

2. The subsystem must be capable of providing 25 fps A velocity for 
rendezvous . 

3. The subsystem must be capable of providing a A velocity of 
550 fps to the ESS (without payload) for deorbit. 

4. The OMS must have a service life of 24 hours. 

5. The vehicle must be controllable with one OMS engine out. 

As a result of meeting the basic requirements, a number of other 
design requirements result, which include withstanding orbit environment 
and zero-g start. 

OMS General Description . Two 10, 000-pound thrust engines are 
utilized for orbit-maneuvering. The engines used are the orbit-maneuvering 
engines being developed for the space shuttle orbiter. They will be mounted 
at Positions II and IV with the thrust chamber exit plane at the same station 
as the main engine with its nozzle retracted. The engine burns LOg and 
LHg. The characteristics of the engine are shown in Table 2-12. 

Propellants are stored in four series-fed LHg tanks and a LOX tank 
inside the main engine thrust cone. All tanks are HPI- protected, Dewar 
type tanks, the feed tanks employing a thermodynamic vent system to mini- 
mize boil-off and ullage venting. The LHg tank volume is 208 cubic feet 
each and the LOg tank volume is 280 cubic feet. Liquid propellant feedout 
under zero g and in adverse load environment during orbital maneuvers is 
achieved by means of a system of capillary barriers (screens) and collectors 
(Figure 2-93). The bottom screen in both the LOg and LHg tanks is used to 
retain at the tank bottom the volume of propellants required for the deorbit 
burn. 
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Table 2-12. Orbit-Maneuvering Engine Characteristics 



Parameter 

V alue 

1. 

Thrust 

10, 000 lb 

2. 

Mixture ratio, O/F 

6 to l 

3. 

Specific impulse 

454 sec 

4. 

Chamber pressure 

800 psia 

5. 

Expansion ratio 

255 

6. 

Exit diameter 

48 in. 

7. 

Length, gimbal to exit 

75 in. 

8. 

W eight, thrust chamber 

236 lb 

9. 

W eight, pump s et 

100 lb 

10. 

LO^ inlet diameter 

2. 6 in. 

11. 

LH^ inlet diameter 

2 in. 


An additional screen is provided in the L0 2 and LH 2 tanks to 
compartmentize the tanks and thus maintain propellant position control and 
prevent condensation of tank ullage. A series of collector tubes is provided 
at the tank walls to provide a flow path between compartments during negative 
g burns (up to -0.030g). A start basket and a supplemental collector mani- 
fold in the bottom compartment of each tank is provided to feed vapor-free 
propellant to the tank outlet during low-g OMS engine start or during -X axis 
or lateral accelerations for any ACPS burn. 

The propellant budget for the design reference mission is shown in 
Table 2-13. As can be seen, a margin exists with the planned ESS tankage. 
Table 2-14 converts the margin to A velocity, assuming the heavy MDAC 
space station payload. For lighter payloads, even more margin exists. The 
design reference mission also represents a worst-case for the orbital 
maneuvers required. 


2-212 


SD 71-140-2 





SD 71-140- 


Table 2-13, Propellant Budget, APS Baseline Mission — MDAC Space Station 


c-o 

I 

ro 

H-* 


ro 


Maneuver /Item 

Propulsion 

AV 

(fps) 

I TOT 

(lb-sec) 

Pounds of 
Propellant 
(TOT) 

BOX 

LH 2 

Tank capacity 

N/A 

N/A 

N/A 

21, 460 

17,890 

3570 

Basic Mission 







1. Circularize at 100 nm 

OMS 

63 

0. 59 x 10 6 

1307 

1122 

187 

2. Transfer to 260 nm 

OMS 

558 

5. 10 x 10 6 

11, 309 

9696 

1616 

3, Terminal phase 

OMS 

25 

0. 23 x 106 

499 

428 

71 

initiation 







4. Terminal phase final 

ACPS 

24 

0. 22 x 10 6 

580 

43 5 

145 

5. Attitude control 

ACPS 

N/A 

0. 30 x 10 6 

820 

615 

205 

6. Deorbit 

OMS 

550 

1. 37 x 106 

3035 

2604 

433 

7. Boil -off 

N/A 

N/A 

N/A 

50 

0 

50 

8. Chill -down 

N/A 

N/A 

N/A 

170 

0 

163 

9. Unusable residual 

N/A 

N/A 

N/A 

120 

100 

20 



1220 

7. 81 x 10 6 

17, 890 

15, 000 

2890 

Margin 




3570 

2890 

680 












Table 2-14. Propellant Margin for Contingency, 
APS Baseline Mission-MDAC Space Station 


Maneuver Item 

Propulsion 

AV (fps) 

*TOT 

(lb-sec) 

Pounds of 
Propellant 
(TOT) 

L °2 

LH 2 

Total margin 
available 

N/A 

N/A 

N/A 

3570 

2890 

680 

Margin used for 
orbit maneuver 

OMS 

171 

1. 52 x 10 6 

3372 

2890 

482 

or 







Margin used for 
attitude control 

ACPS 

113 

1. 01 x 10 6 

2720 

2040 

680 



NOTE 




Shown is the propellant margin utilized for OMS 

or ACPS. 




The TVC system concept for the OMS will be essentially the same as 
that for the main engines. Each engine will be gimbaled by two electro- 
hydraulic servo actuators. However, unlike the situation in the main engine 
systems, the sole pumping source in each system will be an electric powered 
pump. Also, since the OMS/TVC must remain operational throughout the 
complete mission, the pump will be periodically operated during orbital 
coast periods to maintain adequate system temperature and thus assure that 
the TVC will be operable in subsequent OMS burns. A temperature sensor 
located in the cold point of each system will control operation of the applica- 
ble pump during orbital coast periods. 

If the final design of the engine and supporting stage structure will 
allow suitable envelopes for the actuators, all the system components will be 
packaged in the actuators. If this packaging is possible, the plumbing will be 
reduced to just two lines that interconnect the two actuators. 

The two gimbal axes will be offset 45 degrees from the vehicle pitch 
and yaw axes in the same manner as those of the main engines. Each 
actuator will be capable of gimbaling the engine ± 6 degrees and thus to 
effect pitch, yaw, and roll deflections of ± 8.4 degrees. Each engine will be 
canted radially outboard 9 degrees {nonfiring) and 8 degrees (firing) in order 
to point the thrust vector toward the vehicle center of gravity and make pos- 
sible vehicle control with only one engine firing. During deorbit (no payload), 
with one engine out, the remaining engine cannot point through the center of 
gravity; so the ACPS is used for flight control. 
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The actuator orientation and a simplified TVC hydraulic system 
schematic are pictured in Figure 2-93. 

Although it is not a requirement that the ESS be designed to conform to 
fail operational/fail safe (FO/FS) criteria for orbital maneuvers, the FO/FS 
criterion has been applied for the following two reasons: 

1. The OMS is integrated with the ACPS which is required to be 
FO/FS since attitude control affects orbiter crew safety during 
the ESS engine and avionics recovery operation. With the excep- 
tion of the OMS engine thrust chamber assemblies, the OMS must 
therefore be FO/FS. 

2. The OMS is utilized for deorbit. Although this fact does not affect 
orbiter crew safety, it can have an effect on human life. For this 
reason the FO/FS criterion has been applied. 

The FO/FS analysis of the OMS is presented in Table 2-15. Two 
conditions were identified in which the subsystem is not FO/FS. They are 
the following: 

1. There are only two sets of OMS pumps on the ESS. Since the 
pumps are required for both OMS and ACPS operation, any failure 
that results in a condition of both LOg pumps or both LHg pumps 
being inoperative will disable the ESS APS. The failures could be 
to the pumps themselves or to equipment required to operate the 
pumps (CG's, valves, etc.). 

2. If both LO 2 fill valves fail open, the APS LO 2 will be bled 
overboard. 

These two conditions have been waived based on the following rationale 

1. Two pump sets are considered adequate since the ESS design life 
is only 24 hours. The pumps are being developed for the space 
shuttle orbiter and will be designed to operate for much longer 
missions. Thus, the probability of two failux-es is considered 
remote enough to preclude the addition of a third set of pumps. It 
should also be noted that the failures must be of both LOg or of 
both LHg pumps to render the APS inoperative. Failure, for 
example, of a LOg pump and of an LHg pump will not render the 
subsystem inoperative. 
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Table 2-15. OMS Fail-Operational/Fail-Safe Considerations* 


Failure 

Remarks and Rationale 

OMS engine 

After first engine failure, the second engine provides operational 
capability. After the second engine failure, the translation ACPS thrusters 
provide fail-safe backup. 

L£>2 pump 

After the first pump .failure, the second L , pump provides flow to 

keep the second OMS engine on line, and the subsystem is operational. 
After the second failure, neither the OMS engine nor the ACFS thrusters 
are operative, so that the subsystem cannot be considered fail-safe. The 
FO/FS requirement for the second failure is not met. 

LH2 pump 

Same as for LO? pump. The FO/FS requirement for the second failure is 
not met. 

Pump drive GG 

After the first failure, the subsystem remains operational. If the first 
failure is a ROg pump drive GG and the second is an LH2 drive GG (or 
vice versa), the system is fail-safe, inasmuch as the ACPS provides 
backup. If the two failures are both LO2 pump drive GG's or LH2 pump 


drive GG's, the subsystem is inoperative and does not meet FO/FS 


re qui r ements . 

Tank repressurization 
regulator 

Three regulators with appropriate isolation valves are provided so that 
the subsystem remains operational after the second failure. 

Propellant tank vent 

Since the system is designed so that the APS tank never relieves in flight, 
the first failure mode is that relief is required. If the relief valve fails 
(second mode), a backup burst diaphragm and relief valve are provided. 

Fill valves 

Two fill valves in series are provided to assure fail-operational capability. 
If both I1H2 fill valves fail open, fail-safe is provided by sealing in the 
disconnect. If both LO^ fill valves fail open, LO2 will drain overboard as 
the APS li 02 fill tees off the main fill, and there is no sealing discon- 

nect. The LO 2 fill is therefore not FO/FS. 

Pre valves 

The first failure mode is that the prevalves be required to close since they 
will normally be left open for the entire flight. Two prevalves in series 
are provided so that the subsystem is FO/FS. A closed failure of the 
prevalve is not considered. If a closed failure is considered, the failure 
of two prevalves could result in the subsystem's being inoperative. 

Thermodynamic vent 

The thermodynamic vent is designed with redundant components to provide 
fail-operational capability. With the second failure, the vent becomes 
inoperative but this is considered a fail-safe condition since adequate time 
is available between the failure of the vent and any detrimental effects to 
terminate the mission and safely deorbit. 

Feedline /turbopump 
coolant 

The coolant circuit is designed with redundant components to provide fail- 
operational capability. With the second failure, the coolant circuit becomes 
inoperative, but this condition is considered a fail-safe condition since the 
OMS engine inlet valves can be opened and the pump inlet conditioned by 
bleed as a backup fail-safe mode. 

GG inlet valves, 
regulators, select 
valves, check valves, 
etc. 

The various system components are installed (with applicable redundancy) 
as required to support the prime component (GG, pump) operation. For 
this analysis, they may be considered a part of the prime component and 
the same considerations will apply. For instance, if the oxygen inlet valve 
to both LO2 pump drive GG's fail, the system is inoperative. 

"'It should be noted that not meeting FO/FS usually does not involve crew survival (safety), aince when 
the OMS engines are operating, the vehicle is unmanned. 
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2. The LC >2 fill valves will be closed on the ground, and the position 
will be verified. The open failure of two valves which do not have 
inflight control (inadvertent opening is impossible) is so remote as 
to warrant not applying the FO/FS requirement,. 

OMS Operation. The orbit maneuvering subsystem for the ESS will 
operate in the same manner as the space shuttle OMS. 

Prior to lift-off, liquid oxygen and hydrogen are contained in the 
APS tanks, the propellant tanks are pressurized, and the feedline and turbo 
pump cooling is initiated. The prevalves are open and liquid propellants 
are present in the feed and pump system throughout the mission. 

The turbo pumps are powered by individual gas generators and supply 
liquid oxygen and hydrogen to the regeneratively cooled engine thrust cham- 
ber. Ignition is provided by redundant spark plugs. The turbine exhaust is 
vented overboard via a propulsive vent (for each engine) which provides 
100 pounds of the total engine thrust of 10, 000 pounds. 

Pressurization of the propellant tanks is accomplished by tapping 
hydrogen gas from the thrust chamber and tapping oxygen from the LO 2 
pump discharge and passing it through a coil around the EOg pump turbine 
drive gas generator. 

A typical start sequence of the OMS engine is shown in Figure 2-94. 

The OMS engines operate simultaneously, and thrust vector control is 
provided by gimballing the thrust chambers. 
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Figure 2-94. Orbit 



System Start Sequence 




2.3 AVIONICS SUBSYSTEM GROUP 



The following prime issues were derived from negotiations after the 
submittal of the Phase A report and taken as items to be addressed and 
resolved during the Phase B study: 

1. The use of a 33 -foot-diameter instrument unit (IU) as -defined by 
Configuration II, Task 5 Change Order 1928, (INT-21) or, 
alternately, the incorporation of the guidance, navigation, and 
control (GN&C) functions into the expendable second stage (ESS). 

2. The use of conventional (relay- logic) type equipment or the 
advancement to state-of-the-art, solid-state, integrated, central- 
control-type equipment. 

3. Investigation of the feasibility and practicality of recovering high 
value avionic equipment from orbit. 

The Phase B study activities have produced a subsystems approach 
which satisfies study objectives of performance, low cost, and minimum 
development risk. Figure 2-95 illustrates the selection process of the 
avionics approach and the transition from the Phase A recommendation. 

As shown in Figure 2-95, a 33 -foot-diameter instrument unit, modified 
to incorporate redundancy, was excessive in cost and complexity. Hardware 
growth and environmental control demands for the 24-hour baseline mission 
could be accommodated by conventional avionics equipment, but many periph- 
eral items were added when the Phase B baseline configuration was 
established. 

The initial decision to integrate the GN&C functions into the ESS to 
minimize costs provided the basis from which to reevaluate the systems 
approach. Table 2-16 presents the selection criteria. This, together with 
the selection of a vehicle configuration, provides a baseline for building 
the rational network from which final decisions were made. 

As shown in Figure 2-95, the Phase B approach for avionics subsys- 
tem selection is to utilize shuttle -developed equipment and software, to 
utilize Apollo/Saturn hardware where cost and functional requirements are 
satisfied, and to develop new hardware only if existing equipments do not 
satisfy the need. 

Figure 2-96, shows the derivation of equipment to be used on the ESS. 
This figure illustrates a minimum demand for new components for the ESS. 
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Figure 2 -9 6. Avionics Hardware Sources 



© 

Figure 2-9?> shows the avionics configuration proposed for the ESS. 
Table 2-17 lists the components and fault tolerance allowed. 

The following is a brief description of the major subsystem elements 
and their function in the ESS mission: 

1. Data and Control Management (DCM) Subsystem, The DCM sub- 
system is the brain and nerves of the ESS avionics subsystem and 
as such is the central integrating agent for all ESS functions. 

The subsystem consists of the hardware and software to address 
storage, fetch, and store information, process arithmetic and 
logical data, execute sequential instructions, process interrupts, 
and initiate communications between storage and the input/ 
output devices. 

2. Guidance, Navigation, and Control (GN&C) Subsystem. The func- 
tion of the GN&C subsystem is to determine the position, velocity, 
attitude, and attitude rate of the vehicle, to compute, via the DCM 
subsystem, desired changes to any or all these vehicle states in 
accordance with internally stored or alterable computer programs, 
and to provide control signals to the propulsion systems for 
accomplishing those changes. 

3. Communications (COMM) Subsystem, The COMM subsystem 
provides the capability to transmit and receive all RF information 
necessary to accomplish the basic ESS mission by providing 
telemetry data, turnaround ranging data, receiving up-data, and 
range safety commands. 

4. Electrical Controls (EC) Subsystem . The EC subsystem is the 
interfacing agent between the avionics subsystem and the non- 
avionics subsystem. Requirements for this subsystem are 
primarily established by the nonavionic subsystems. Demands 
upon the DCM subsystem for operation are established by the EC 
subsystem and the redundancy and operations criteria for the 
following subsystem elements: main engine, auxiliary propulsion, 
engine actuation, pressurization propellant feed, propellant 
management, separation, safing, propell'ant dispersion, and 
equipment recovery and subsystem elements. 

5. Instrumentation Subsystem . The instrumentation subsystem 
provides for all measurements not involved in systems monitoring'. 
These include tank temperatures, insulation temperature, vibra- 
tion, and noncritical pressures. The requirements for signal 
conditioning, multiplexing, and bridges are 'included in this 
system. 
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6. Electrical Power and Distribution (EPD) Subsystem . The electri- 
cal power and distribution subsystem consists of the energy sources 
and the distribution and conversion of electrical power for all 
avionic system loads. Two dc voltage levels of 28 and 56 vdc have 
been established for the basic power buses. The 28-vdc buses will 
supply all 28-vdc vehicle loads. The 56-vdc bus will be used for 
•conversion to all ac-voltage levels required. 

Batteries have been selected as the energy source for the 24-.hour 
mission. Approximately 2500 pounds of batteries are required to support 
the ESS mission. 

The equipment required to provide fault tolerance levels are shown on 
the block diagram. Figure 2-97. Thenumbers utilized for ESS are noted 
in Table 2-17. Where Apollo/Saturn equipment is used to fulfill redundancy 
requirements, the usage is so noted. The configuration established by the 
above is in concert with the ESS redundancy guideline which is: 

"From mated ascent through booster /ESS separation, all 
items that may affect booster safety shall be FO/FS. 

During ESS boost and orbital operations, redundancy for 
subsystems and components shall be determined on an 
individual basis, considering criticality and cost 
effectiveness. Equipment used for rendezvous and/or 
deorbit shall be FO/FS. " 

The avionics equipment installations have been arranged to minimize 
demands on the environmental control system, thereby minimizing demands 
on the vehicle power system. Cold areas of the vehicle are used for high- 
heat-producing equipment. This is supplemented by high-performance 
insulation and coatings for the containers. This design approach has 
enabled the environmental control system to be limited to use of heaters and 
heater control equipment. Coldplates or heat pumps will not be required 
based upon the analysis completed to date. Figure 2-98 reflects the installa- 
tion arrangement for the avionics equipment. 

One prime method of reducing total program costs would be to recover 
high-value components from orbit. Items under consideration are the main 
propulsion system engines and aft-mounted avionics equipment. 

Analysis has determined that maximum recoverability of avionics 
equipment is necessary to gain a minimal cost advantage. Three options 
were analyzed in an. attempt to fully explore the potentials of recovery: 

Option I, no recovery; Option II, partial recovery; and Option III, maximum 
recovery. Table 2-18 shows some of the considerations given to the recovery 
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Table 2-18. Deorbit Considerations 


Consideration 

Option I 
No 

Recovery 

Option II 
Partial 
Recovery 

Option HI 
Maximum 
Recovery 

Mission time line impact 

No 

Yes 

Yes 

Software changes for recoverability 

No 

Yes 

Yes 

Development of recovery methods 

No 

Yes 

Yes 

Environmental effect on removed 
hardware 

No 

Yes 

Yes 

Added failure modes due to recovery 

No 

Yes 

Yes 

Added checkout requirements 

No 

Yes 

Yes 

Refurbishment costs 

No 

Yes 

Yes 

Cost of new hardware recoverable *~ 
installation, packaging, safing 

No 

Yes 

Yes 

Shuttle support for deorbit 

No 

Yes 

Y es 

Highest initial hardware cost 

No 

No 

Yes 

Highest total program cost 

Yes 

No 

No 


analysis. Each "yes" must be considered as a negative or undesired 
characteristic. Table 2-19 reflects pure hardware cost savings which could 
be realized. 

Because of the ramifications of this approach, an in-depth analysis is 
recommended to determine the optimum selection, as the impact of the 
following unknowns has not been established: 

1. Software changes for safing and deorbit 

2. Development of recovery techniques 

3. Mission time-line constraints 
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Table 2-19. Forecasted Hardware Savings (Option 1 Versus Option III) 


COMPONENT 

OTY 

OPTION 1 
(NONE) 

OPTION ;i 
(PARTIAL) 

OPTION Ml 
(MAX) 

IMU 

3 

- 

$900 K 

$900 K 

CPU/MAIN MEMORY 

4 

- 

- 

1320K 




$900 K 

$2220K 

OTHER COSTS 





REFURBISHMENT 


- 

$360K 

$ 888K 

INSTL& CHECKOUT 



150K 

387K 

NEW DEORBIT KIT 



- 

600 K 

DELTA PACKAGING COSTS 



240K 

300 K 




$750 K 

$2175K 


BASED UPON THE ABOVE: 

OPTION I NO RECOVERY, BUILD 20 SETS ($2,220K EA) ^ $44. 4M 

OPTION III RECOVERY, BUILD 5 SETS & REUSE 


BUILD 5 SETS 11.1 M 

INSTALL & C/O (15 SETS) 1.6 M 

REFURBISHMENT (15 SETS) H.lM 

DELTA PACKAGING COST 6.0 M 

DEORBIT KIT (20 SETS) 12.0 M 


$ 41 .8 M -41.8 

FORECASTED HARDWARE SAVINGS $2.6 

(OPTION I vs OPTION 111) 

(BASED ON IMU COST OF $300K EA AND 
CPU/MEMORY UNIT COST OF $330K EA) 
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Effect of thermal shock on removed equipment 

5. Added failure modes 

6. Demands upon shuttle orbiter for attitude orientation for deorbit 

Alternately, if the assumed cost of refurbishment can be lowered or 
the number of equipment sets reduced, additional savings may be possible. 
Further evaluation appears to be warranted. 

Techniques have been explored in accomplishing separation of the 
equipment containers with shaped charges similar to the method developed 
for the Saturn program. These devices, as well as -separation-type 
electrical connectors, are well within existing technology. Shaped charges 
would also be utilized to cut away the aft closeout to provide access to the 
equipment containers. Figure 2-99 depicts one proposed method of providing 
access for a recoverable equipment installation. (See Section 2.3. 7 for 
additional details on equipment recovery installations, and Section 2.3.8 for 
deorbit avionics description.) 

A hardwire interface will be provided to enable the booster crew to 
monitor critical ESS functions during the ascent phase and, if necessary, to 
initiate the separation phase for abort purposes. Although not required, the 
capability to update the ESS navigation equipment is inherently provided by 
this interface. The physical interface will be accomplished in a similar 
manner as proposed for the booster /orbiter interface to minimize special 
devices for the booster/ESS. 

Acquisition, control, and test (ACT) select buffers will be interposed 
between the ESS and the booster data buses to isolate and provide the means 
of coupling the systems together. Each ACT/select buffer is capable of 
withstanding short circuits on the input without outputting spurious signals 
to either data bus. Redundant paths will be provided on each side of the 
vehicle. The ESS ACT/select buffers will be installed in the forward skirt. 
The hardware cables will be routed in each of the booster forward struts. 

The proposed installation is shown in Figure 2-100. 

A hardware interface will be provided to enable the electrical support 
equipment (ESE) to check out and monitor all ESS functions. The prime 
interface is with the universal test console (UTC) developed for the shuttle 
program. This piece of equipment will utilize common software routines to 
fully check out and support the launch of the ESS. The interface with the UTC 
will be through ACT/select buffer units to assure isolation of both the ESS 
and UTC subsystems. Dual interfaces will be provided to maintain redundancy 
requirements. For checkout, additional ESE support is required to provide 
28-vdc and 56-vdc power for battery simulation. 
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The Phase B study activities have achieved the major objectives of the 
study plan and have produced the definition of a viable avionics subsystem. 
However, during this study, several areas were identified where additional 
effort should be expended to develop the system hardware and software. 

These items are applicable to several on-going programs, and certain of 
these items are directly concerned with the Shuttle Program. The following 
are deemed desirable for further development: 

1. Computer software programs represent single-point failures. 
Develop efficient means for program development and transmission 
via the up-link command system of programs and/or subroutines 
for vehicle safing and anomaly correction for which on-board 
programs have not been programmed. Develop time-saving 
methods for programming, coding, verification, and preparation 
for transmission methods from time -of -anomaly to time-of- 
transmission. 

2. Develop all aspects of recovery of avionics equipment from orbit, 
i. e. , mechanical release, interface connectors, handling aids, 
ordnance devices, as well as recovery procedures. 

3. Analyze use of TDRS/MSFN as concerns data transmission, 
up-link command. 

4. Develop an integrated package which could be dedicated to the 
deorbit task. This package is to provide all attitude control, and 
sequencing functions required to deorbit large vehicles from orbit. 

5. Develop a solid-state power control switch which is compatible 
with the data bus /ACT Units being developed for the Shuttle 
Program. The switches must meet short-circuit trip and possess 
no single -failure modes. 

6. Analyze and develop requirements for static inverters in the 
5-kw to 10-kw rating range. 

7. Develop a technique to utilize the shuttle orbiter to align the ESS 
in preparation for ESS deorbit. 

2.3.1 Guidance, Navigation, and Control (GN&C) Subsystem 

This section presents the results of preliminary trade studies, 
performance analyses, and equipment evaluations performed to define a 
cost-effective, reliable GN&C subsystem which will satisfy the requirements 
imposed by all ESS reference missions. 
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A coordinated ESS GN&C study has been performed by IBM and 
documented in IBM Study Report MSFC-DRL-008A, Astronics Systems 
Study for Saturn S-II Expendable Second Stage, dated (3 0 June 1971). 
Applicable material has been incorporated into this report. 

GN&C Requirements 

The following sections summarize the background, assumptions, and 
interpretations from which the GN&C subsystem requirements were derived, 
followed by a definition of the requirements, and an explanation of the 
rationale and analyses used in arriving at these subsystem requirements. 

Mission Requirements . The primary ESS GN&C requirement will be 
to inject the baseline payloads into appropriate low-earth orbit without a 
phasing or rendezvous requirement. Rendezvous with a passive target 
vehicle in a 270-nm circular orbit is considered to be a secondary require- 
ment. The baseline payloads and associated GN&C related mission 
parameters are as follows: 

1. Inject a space tug payload into a 100-nm circular orbit at 

28. 5 degrees inclination. This will be accomplished by first- 
stage boost to approximately 38 nm; separation from the booster; 
an ESS main engine burn into a 66-nm by 100-nm eliptical orbit; 
coast to near apogee; and finally, an OMS burn to circularize at 
100 nm. The ESS will release the payload, move to a safe distance, 
and wait for the orbiter rendezvous. The orbiter will dock with the 
ESS, and remove and stow main engines and selected avionics 
equipment. The orbiter will then enable the deorbit control sys- 
tem and maneuver the ESS into the inertial attitude required for 
d'eorbit to establish the attitude reference for deorbit. The 
orbiter will undock, move to a safe distance from the ESS, 
activate ESS propulsion systems, wait for ESS to reacquire 
deorbit attitude, and command the deorbit burn sequence. The 
trajectory and significant mission events for this mission are 
depicted in Volume II, Book 1, Paragraph 5.2.2. 

2. Inject a MDAC space station payload into a 270-nm circular orbit 
at 55 degrees inclination. This will be accomplished by injecting 
the ESS /payload combination into a 100-nm circular orbit as 
described in the space tug mission (Item 1 above) and remaining 
in the 100-nm orbit long enough to make at least two navigation 
updates to reduce position and velocity errors to an acceptable 
level. An OMS burn will then be initiated to achieve a 100 by 
270-nm eliptical orbit. The ESS will coast to near apogee where 
an OMS circularization burn will be made to achieve a 270-nm 
circular orbit. 
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The separation from the payload, docking with orbiter, removal of 
main engines selection of avionics equipment, and the deorbit 
sequence will be identical to those described for the space tug 
mission. The trajectory and significant mission events are 
depicted in Volume II, Book 1, paragraph 5. 2.2. 

3. Inject a reusable nuclear shuttle (RNS) into a 260 nm circular orbit 
at 31. 5 degrees inclination. This will be accomplished in an 
identical manner to that for the MDAC space station mission 
described in Item 2 above except for the differences in altitude and 
inclination. 

4. Rendezvous a MDAC space station payload with a passive target in 
a 270-nm, 55-degree inclination circular orbit. This is accom- 
plished by injecting the ESS/payload combination into a 100-nm 
circular orbit (as described in the space tug mission. Item 1 
above). The ESS will remain in the 100-nm orbit long enough to 
phase and to make sufficient navigation updates to reduce the 
errors to acceptable levels. An OMS burn will then be initiated to 
inject into a 100 by 260-nm eliptical orbit. The ESS will coast to 
near apogee where an OMS circularization burn will be made to 
achieve a 260-nm circular orbit. A minimum of one navigation 
update will be made during the ascent. Fine phasing with the 
target vehicle will be accomplished in the 260-nm circular orbit, 
followed by a transfer to a 270-nm circular orbit in the proximity 
of the target. Multiple navigation updates will be accomplished 
during phasing and station-keeping. Separation from the payload, 
docking with the orbiter, removal of main engines and avionics 
equipment, and deorbit sequences will be identical with those 
described for the space tug mission. The trajectory and significant 
mission events are depicted in Volume II, Book 1, Para- 
graph 5.2.2. 

Ground Rules and Guidelines. The following ground rules and 
assumptions form the background for this study: 

1. The baseline GN&C will be configured to meet the requirements 
of the basic (nonrendezvous) missions described in the previous 
section. 

2. Subsystem performance capabilities for rendezvous with a passive 
target in a 270-nm circular orbit, using only the baseline GNStC, 
will be defined, including launch constraints. 
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Subsystem refinements and operational requirements required to 
effect close rendezvous (2 ± 1 nm as a goal) with passive targets 
in 270-nm circular orbits will be discussed. 

4. Subsystem refinements and operational requirements required to 
accomplish a synchronous orbit will be discussed. 

5. Fail safe/fail operational (FO/FS) configuration at lift-off of all 
subsystem elements which might affect safety of the crew in the 
booster, the target vehicle, or the shuttle orbiter, is considered 
mandatory. Disposition of malfunctions and associate decisions 
to continue or abort the mission subsequent to lift-off will be 
considered a function of mission rules. 

6. Reliability goals will be such as to be consistent with less than 
0. 5-percent probability of one unsuccessful mission to the GN&C 
failures in 20 missions. 

7. Deorbit of the expended ESS to an acceptable impact area with an 
acceptable footprint is mandatory. 

8 . Mission duration will be limited to 24 hours (launch through 
deorbit). 

9. A tracking and data relay satellite (TDRS) system is assumed to 
be available with no cost to the ESS program. 

10. Navigation updates will be accomplished without any requirement 
for special vehicle maneuvers or positioning and with no changes 
required to existing manned space flight network (MSFN) 
stations. 

11. Shuttle -developed hardware and software will be utilized to the 
greatest extent possible to minimize new development and evalua- 
tion and qualification costs, and to maximize use of shuttle GSE 
and development tools. 

12. Engine on-off drivers for the QMS and ACPS, and engine gimbaling 
servo -amplifiers for the main engines and OMS engines are con- 
sidered to be part of the GN&C subsystem. 

13. The main engine computers, the data control and management 
(DCM) subsystem, the engine gimbaling servo -actuators, the 
OMS and ACPS propellant valves, and the OMS and ACPS igniters 
are considered to be significant interfaces. 


2-242 


SD 71-140-2 



o 

Functional and Performance Requirements. The GN&C, together with 
appropriate interfacing subsystem elements (DCM, main engines, OMS, and 
ACPS) and available ground or satellite aids (MSFN and/or TDRS), will 
provide the capability to determine the position, velocity, and inertial 
attitude of the ESS/payload from launch through deorbit. It will also provide 
attitude control from booster separation, through ascent, on-orbit opera- 
tions, on-station operations, and deorbit. This includes thrusting modes 
(mainengine and OMS velocity changes) and nonthrusting modes (angular 
maneuvers and attitude holds using ACPS). 

The GN&C will perform the above functions by providing individual 
equipment with accuracies and drift characteristics compatible with the 
performance requirements defined in Table 2-20. 

The GN&C will be compatible with the functional requirements by 
mission phase listed in Table 2-21 for the nonrendezvous baseline mission 
and in Table 2-22 for the rendezvous mission. 

The GN&C will be capable of self -alignment during prelaunch and 
require no attitude updates throughout the mission. 

GN&C Subsystem Description 

The following sections describe the baseline GN&C subsystem selected 
for ESS. 


Functional Description. A functional block diagram of the ESS GN&C 
is shown in Figure 2-101. The diagram depicts a system which utilizes: 

1. Inertial navigation data for GN&C operations 

2. No attitude reference update from launch through deorbit 

3. Navigation updates through MSFN and/or TDRS tracking and uplink 

4. Blending /filtering of navigation data to provide an optimum state 
vector 

5. Separate rate sensors for stability augmentation 

6. Automatic operation with checkout and fault isolation used in 
redundancy switching 

7. Digitally computed guidance steering laws for all phases 
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Table 2-20. GN&C Performance Requirements 


PERFORMANCE PARAMETER 

MISSION 


100 N.M. 

270 N.M. 

270 N.M. 
W/REND. 

In.iect ion Errors (3<r): 




• Radial position 

+3 N.M. 

±5 N.M. 

— 

• Radial velocity 

+20 fps 

+50 fps 

— 

• Tangential velocity 

+15 fps 

+15 fps 

— 

• Inclination 

+ 0 . 1 ° 

+ 0 . 1 ° 


Rendezvous Errors (3 0~): 




• Position 

— 

— 

11 + 10 N.M. 

• Velocity 

— 

— 

+15 fps 

De-orbit AV Errors: 




• Direction (pitch & yaw) 

±5° 

±5° 

±5° 

• Magnitude 

±42 

±42 

±42 


The major functions -sensor-control relationship employed by the GN&C 
system is described in the following paragraphs. 

Prelaunch. All ESS GN&C system elements are operational during 
this phase (to facilitate checkout). There are two major system categories 
involved in the prelaunch phase: (1) ground operations and (2) vehicle 

functions. The ground operations relate to total checkout, mission planning, 
and developing data necessary to booster and ESS GN&C subsystem initializa- 
tion. The vehicle functions relate to ESS initialization, checkout, and basic 
navigations. The basic navigation function is effected near launch phase 
terminations just before liftoff with an inertial measurement unit and compu- 
tational equipment. Checkout is accomplished primarily with automatic 
on-board computational equipment with ground controllers as backup. 
Initialization is strictly a computational function except for alignment, which 
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Table 2-21. GN&C Functional Requirements 
(Nonrendezvous Baseline Mission) 


Mission Phase 

F unctionai Requirements 

1. Prelaunch 

' 

Ground operations 

Check out avionics system (combina- 

On-board operations 

tion of on-board and ESE). 

Load and verify flight program. 

Load targeting data and other 
parameters. 

Align IMU (level and gyro compass). 
Provide on-board targeting refinement 

2. Ascent 

Mated ascent 

to time of launch. 

Provide navigation (after ground 
r elease). 

Perform powered flight navigation. 


Provide abort capability. 

Provide for main propulsion system 
(MPS) startups. 

Separation 

MPS startup commands. 

Boost to insertion 

Provide attitude control and 
stabilization. 

Provide powered flight navigation. 

(66 by 100 nm orbit) 

Provide ascent phase guidance. 

i 

Provide attitude control and 
stabilization. 
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Table 2-21. GN&C Functional Requirements 
(Nonrendezvous Baseline Mission ) (Cont) 

Mission Phase Functional Requirements 

Coast to apogee Perform coast phase navigation. 

Provide attitude control and 
stabilization. 

Provide for OMS startup. 

Circularize orbit Provide powered flight navigation. 

( 100 by 100 nm) 

Provide ascent phase guidance. 

Provide attitude control and 
stabilization. 

3. Orbital operations 

Coast in parking orbit Provide orbital navigation. 

Provide attitude control and 
stabilization. 

Perform navigation updates. 

Compute transfer burn parameters. 

Compute and count time to transfer 
maneuver. 

Boost into coelliptic Provide powered flight navigation, 

transfer orbit 

(100 by 270 nm) Provide transfer phase guidance. 

Provide attitude control and 
stabilization. 

Coast to apogee# Provide coast phase navigation. 

Provide attitude control and 
■stabilization. 

*Midcourse correction may be needed during the ascent phase to correct 
• . out-of -plane conditions. 
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Table 2-21. GN&C Functional Requirements 
(Nonrendezvous Baseline Mission) (Cont) 


Mission Phase 

- 

Functional Requirements 


Compute time to circularization burn. 


Perform navigation updates (when 
coverage is available). 

Circularize orbit 

Provide powered flight navigations. 

(270 by 270 nm) 

Provide transfer phase guidance. 


Provide attitude control and 
stabilization. 

4. On-station operations 


Stationke eping 

Provide coast phase navigations. 


Provide attitude control and 
stabilization. 


Perform navigation updates. 


Compute burn parameters for station 
corrections. 


Execute burns (APCS engines) 

Jettison payload 

Provide coast phase navigation. 


Provide attitude control and 
stabilization. 


Initiate payload jettison. 

Provision for coop- 
eration docking (for 

Provide attitude for docking. 

shuttle docking) 

Provide rate hold mode. 

Initiate recovery ordnance 
Disable attitude control at contact. 

Salvage components 

Initiate last release recovery ordnance 
and recover engines and avionic packages j 
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Table 2-21. GN&C Functional Requirements 


(Nonrendezvo 

us Baseline Mission) (Cont) 

Mission Phase 

Functional Requirements 

Preparation for 

Initialize deorbit system (data and 

de-orbit 

positioning by shuttle). 

Shuttle -ESS undocking 

Provide rate damping and attitude hold 
mode after separation. 

5. Deorbit 


Coast in orbit 

Establish and maintain deorbit attitude 
(based on shuttle attitude initialization). 


Count time to deorbit burn (or await 
command through radio command). 

Performance of retro 

Initiate burn. 

burn - 

Provide attitude control and 
•stabilization. 


Measure burn time (or velocity 
change). 


Terminate burn. 


involves IMU leveling and gyrocompassing. The prelaunch functional block 
diagram is shown in Figure 2-102. 

Mated Boost. The boost functional block diagram is presented in 
Figure 2-103. The booster provides the primary mated vehicle guidance, 
navigation, and control functions , which are summarized as follows: 

1. Navigation/guidance . Accomplished by a four-gimbal IMU with 
digital computation of state vector and steering commands. 

2. Control . Accomplished with attitude, rate, and acceleration 
sensing, digital computation of control law, and electronic 
drive of TVC servos. 
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Table 2-22. GN&C Functional Requirements 
(Rendezvous Baseline Mission) 


Mission Phase 


1. Prelaunch 


Functional Requirements 


(Same as for nonrendezvous mission; 
see Table 2-21) 


2. Ascent 


(Same as for nonrendezvous mission'; 
see Table 2-21) 


3. Orbital operations 


Coast in phasing orbit 


Provide orbital navigation. 


Provide attitude control and 
s tabilization. 

Perform navigation updates. 

Compute transfer burn parameters. 

Compute and count time to transfer 
maneuver. 


Boost into co elliptic 
transfer orbit 
(100 by 260 nm) 


Provide powered flight navigation. 
Provide transfer phase guidance. 


Provide attitude control and 
stabilization. 


Coast to apogee* 


Provide coast phase navigation. 


Provide attitude control and 
stabilization. 

Count time to circularization burn. 
* Perform navigation updates. 


^Navigation updates required during ascent. 


2-249 


SD 71-140-2 






© 

Table 2-22. GN&C Functional Requirements 
(Rendezvous Baseline Mission) (Cont) 

Mission Phase Functional Requirements 

Circularize orbit Provide powered flight navigation. 

(260 by 260 nm) 

Provide transfer guidance. 

Provide attitude control and 
stabilization. 

Coast in parking orbit Provide orbital navigation. 

Provide attitude control and 
stabilization. 

Perform navigation updates. 

Compute rendezvous burn parameters. 

Compute and count time to start 
rendezvous maneuvers. 

Rendezvous with Provide rendezvous phase guidance, 

target 

Provide powered/coast navigation. 

Provide attitude control and 
stabilization. 

Perform navigation updates. 

4. On- station operations 

Stationkeeping Provide coast phase navigation. 

Provide attitude control and 
stabilization. 

Perform navigation updates. 

Compute burn parameters for station 
corr e ctions . 

Execute burns (APCS engines). 
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Table 2-22. GN&C Functional Requirements 
(Rendezvous Baseline Mission) (Cont) 


Mission Phase 


Jettison of payload 


Functional Requirements 


Provision for coop- 
erative docking (for 
shuttle docking) 

Salvage components 


I (Same as for nonrendezvous mission, 
I see Table 2-21) 


Preparation for 
deorbit 

Shuttle-ESS undocking 


5. Deorbit 


(Same as for nonrendezvous mission, 
see Table 2-21) 


The ESS GN&C subsystem is fully powered-up and performing its own 
navigation function in preparation for separation. 

Separation/ESS Insertion. Figure 2-104 presents the block diagram 
for the functions performed by the ESS during the separation/ESS-insertion 
mission phase and the booster during separation and return maneuver. 

These functions are summarized as follows: 

1. Guidance / navigation. Accomplished with a four-gimbal inertial 
platform and digital computation of navigation equations and 
steering commands. 

2. Control. Accomplished with electronic drive of main engine 
gimbal actuators and engine throttle, rate sensing, and -digital 
computation of control laws. 

Orbit Operations. Figure 2-105 presents the block diagram for the 
functions performed by the ESS GN&C subsystem during orbit operations, 
including circularization, rendezvous maneuvering, docking, and undocking, 
and deorbit. 

1. Navigation . Accomplished with a four -axis inertial platform and 
digital computation. The inertial system is augmented by MSFN 
and/or TDRS state vector update entered via uplink. 
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Figure 2-101. ESS GN&C Functional Block Diagram (All Phases) 

















Figure 2-102. Prelaunch Phase GN&C Functional Block Diagram 
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Figure 2-103. Mated Boost GN&C Functional Block Diagram 


2-254 


SD 71-140-2 



















INERTIAL 

NAVIGATION 

SENSORS 


UULlt- 

UTERATION 

TRANSCEIVER 


H CONFIGURATION 
Jand 

1 SEQUENCING 


REDUNDANCY 
I'AMGEMENT/ 
FAIL IRE 
MONITORING 


I 1 

J TVC ■ 

*1 ACTUATOR “ 
{ DYNAMICS I 


r. rp . 1 J BOOSTER 1 

♦I * EP , S T”>1 VEHICLE | 

L JETS ^dynamic S j 


PERFORMANCE STAT E VEC TOR 
»’ UNI l l)K I NO/ AND SELECTED 

REASONABLENESS SYSTEM PARAMETERS 
TEST DATA 


Figure 2-104. Separation/ ESS Insertion/Booster 
Return Maneuver 


2-255 


SD 71-140-2 





















SD 71-140- 


INERTIAL 

NAVIGATION 

SENSORS 


NAVIGATION 

(msfn/Tdrs/ 

UPLINK) 


NAVIGATION 

COMPUTATIONS 


NAVIGATION 

DATA 

FILTER 


OMS 

ENGINE 

CONTROL 

DRIVER 


| TVC (OMS) 
SERVO 
| ACTUATOR 
DRIVE 


I 1 

| OMS 

►. ENGINE — 
CONTROL I 

I J 


I , TVC(0Msfl 
ACTUATOR - 
I DYNAMICS | 


1 


•~r 


CO 

I 

CO 

Ul 

O' 


CO 


SYSTEM 

CONFIGURATION 

SELECTION 


CONFIGURATION 

(and 

(SEQUENCING 


STEERING COMMAND 
GENERATION 

. ORBIT MANEUVERS 
. DEORBIT 


CONTROL 

LAW 

GENERATION 


REACTION 

JET 

SELECT 

LOGIC 



I 1 

M r ACPS L ■ 

jets r-f 


REDUNDANCY 


RATE 

MANAGEMENT/ 


1 SENSORS 

FAILURE 


( 

MONITORING 






L. 


..["vehicle ~ L 

jjDYNAMICS^p 


I 


PERFORMANCE 
MONITORING/ 
REASONABLENESS 
TEST DATA 
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Guidance. Accomplished with digital computation. 

3. Control. Accomplished with digital control law computation, rate 
sensing, and electronic drive of attitude control jets (non- 
thrusting periods) and OMS gimbal actuators (thrusting periods). 

Baseline GN&C Subsystem Hardware Description. The GN&C subsys- 
tem is comprised of the following assemblies: 

Inertial measuring unit (IMU) 

Rate sensor assemblies (RSA) 

Attitude/translation driver units (ATDU) 

TVC gimbal servo amplifier (TGSA) 

Significant GN&C interfaces are as follows: 

Data and control management subsystem (DCM), including computers 
and data bus 

OMS and ACPS H 2 /O 2 valve actuators and ignition exciters 
Main and OMS engine gimbal actuators 
MSFN and/or TDRS tracking 
Uplink (state vector update) 

A GN&C functional block diagram, including significant interfaces, is 
shown in Figure 2-106. Installation design and thermal considerations are 
provided in Paragraph 2.3.7 of this section of the report. The following 
paragraphs describe the hardware elements that comprise the ESS GN&C 
subsystem. All GN&C hardware is identical with space shuttle hardware. 
Minor modifications to engine gimbaling and driver units may be required 
to interface with a separate deorbit subsystem discussed in Section 2. 3. 8. 

Inertial Measuring Unit. The IMU consists of two line replaceable 
units (LRU's); the platform and the power supply are shown in Figure 2-107. 
The platform has four gimbals with appropriate synchros, resolvers, and 
torque motors for each gimbal. The angular sequence, starting with the 
inner gimbal, is pitch, roll, and yaw; the fourth gimbal provides redundant 
roll. The stable element (inner member) contains two 2 -degree-of -freedom 
(DOF) gyros with spin rotation axes directed along the platform pitch and 
yaw gimbal axes, respectively. One gyro controls the roll and yaw platform 
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Figure 2-107, IMU Block Diagram 
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gimbals while the other controls the pitch gimbal. The inertial platform 
baseline is typified by a Kearfott KT-70A7. (Refer to Singer -Kearfott 
Division Document ETO - 1075 , " KT-7-0 Inertial Measurement Unit for 
Fighter Aircraft Applications", 3 0 July 1970. ) 

The accelerometers, also mounted on the stable member, consist of 
a two -axis accelerometer, measuring accelerations in the X and Z axis, and 
a single -axis accelerometer measuring Y-axis accelerations. This defini- 
tion applies when the gimbal angles are driven to zero in all axes with 
respect to the vehicle body axis system. The coordinate system X, Y, Z, 
defined in the conventional sense, correspond to the roll, pitch, and yaw 
axes of the vehicle. The gimbal torquing electronics and the accelerometer 
rebalance electronics are located in the platform assembly. 

The platform includes a pulse accumulator circuit to accumulate the 
accelerometer pulses and convert to a binary format, a precision A/D 
converter to convert synchro outputs to a binary format and an ACT unit to 
provide multiplexing and input/output control. The platform ACT unit 
transfers the synchro angles and accumulated delta-V pulses onto the data 
bus with the proper format. It also accepts gyro torquing commands from the 
data bus for realigning the platform. 

The power supply accepts the 28-vdc and 115-vdc, 400 Hz ac power 
from the vehicle power to dc and ac levels compatible with the sensor spin 
motors, electronic circuits, and synchro reference requirements. 

. - - -Rate Sensors. The rate sensor proposed for ESS is the same as 
baselined for both shuttle vehicles and is the existing Honeywell GG1102 
vibrating -wire sensor. This choice was dictated by its very low failure 
rate (1.3 percent/1000 hours) as well as life in excess of 10,000 hours. 

Other unique features include undetectable hysteresis and mass unbalance, 
tight output linearity and flat response to 100 cycles. 

A block diagram of the rate sensor is shown in Figure 2-108. An 
enabling signal applies 28-vdc line voltage to the dc power supply, providing 
bias voltages and oscillator excitation. The oscillator provides a high- 
frequency current exciting both input and output wires. A rate of turn co on 
the input axis induces a coriolis force on the output wire causing it to vibrate 
elliptically. This motion change in a permanent field induces a signal 
proportional to w . The rate signal is preamplified and demodulated, and dc 
amplification is added to provide an appropriate scale factor. 

An external rate simulator signal can be applied for checkout, and 
checkout/fault isolation (COFI) signals fed back include oscillator and power 
supply monitors. One ACT unit is integrally packaged with each rate sensor 
unit for interface between sensor electronics and data bus. 
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Figure 2-108. Rate Sensor Schematic Diagram 
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Nine such, devices are required for each vehicle, three each on the 
vehicle pitch, yaw, and rate axes. Only minor scaling differences are 
anticipated between the three line replaceable unit (LRU) types. The rate 
sensors are presently located in the thrust cone location with the bulk of 
avionics equipment. Flexible body considerations may dictate another 
location when model analyses are available. 

Flexible body control analyses may show that separate rate sensors 
may not be required for stability. Should separate rate sensors be required, 
less expensive rate sensors might be selected, based upon the shorter 
length of the mission (24 hours) and the fact that triple redundancy is 
dictated by the FO/FS criteria. 

The physical design of the LRU will be characterized by sealed, rigid 
construction, and since these are heaterless sensors, heat sink limiting of 
device temperature is required. Breakup into three separate LRU's per axis 
was dictated by the shuttle spatial diversity guideline, but they may be 
combined into one LRU per axis as an optional configuration for ESS 
application. 

Attitude /Translation Control Driver Units. The mechanization of a 
typical N-engine ACFS/OMS driver LRU is illustrated in Figure 2-109. 

In the current system mechanization, these LRU's are available in 
two configurations, driving two or four engines. An "enable" signal for 
each engine control channel, provides ac and dc power to the channel 
activated. Subsequent discrete thrust commands provide either direct input 
to the predriver, or minimum. impulse- inputwia' a' bne-s'hot circuit. A pre* 
driver circuit includes input gating and power gain to the PNP driver 
transistor, which provides on-off control of current to the and O 2 engine * 
valve solenoids. Separate hard-wire connections are made to the two valve 
solenoids to facilitate COFI. 

Transient suppression circuitry is provided in each channel to reduce 
to a manageable level the inductive kick generated by a coil current turnoff. - 
A separate ignition signal feeds a second 28-vdc driver circuit to provide a 
low-power discrete signal to the ignition exciter, which is part of the engine 
system. 

Interface with the data bus is provided by ACT units; three for the 
four-engine LRU and two for the two-engine configuration. Each ACT unit 
provides four discrete signals to each driver channel: 

Channel enable 

Valve command ~ normal 
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Figure 2-109. Typical ACPS/ OMS Engine Driver 
Mechanization (4-Engine Configuration) 


2-263 


SD 71 -L40-2 










Q 

Yalve commad — minimum impulse (ACPS only) 

Ignition on command 

In addition, each ACT unit accommodates four discrete COFI signals from 
each engine control channel to confirm the following: 

Channel bias voltage ] 

Coil driver on 

Ignition signal on 

Engine on 

Multiple isolated dc and ac power lines are required for redundancy 
management and fault tolerance. Each ac line serves a separate bias 
supply, and each dc line is provided with an electromagnetic interference 
(EMI) suppression filter. Four lines are required into each four -engine 
LRU and two each into a two -engine LRU. 

Since the loss of any one of the ACPS or OMS engines allows continued 
mission operations, and since a second engine failure would not cause an 
unsafe condition, only one driver channel per engine is required for FO/FS 
operation. Because of the location of the 14 ACPS engines in one group of 
seven on each side of the vehicle, two four-channel units will be used with 
each seven-engine group and one two -channel unit will -be- used- for the* ' 

.two- -OMS- engines-. ' “ 

TVC Gimbal Servo Amplifiers (TGSA). The mechanization of the 
proposed main engine and OMS gimbal servo amplifiers is shown in 
Figure 2-110. It is identical to those proposed on shuttle. Each control 
servo uses a torque motor input and linear variable differential transformers 
(LVDT) provide loop feedback from the actuator. Each of three ACT units 
interfaces with each of eight gimbal servo channels. A "TVC enable " func- 
tion provides amplifier bias and transducer excitation. Gimbal position 
commands are summed with gimbal position feedback to produce an amplified 
gimbal error signal to the actuator torque motor. An active network is 
presumed to be required for loop stabilization in the position feedback path. 
Conditioned test signals are provided for error amplifier output, actuator 
position, actuator temperature, and differential pressure. 


Growth capability permits addition 
of at least four more COFI functions 
per engine control channel. 
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For gimbal control, a dual-section position servo actuator is used. 

Each section consists of two channels, one active and a dead-ended monitor. 

In the section carrying load, a difference sensed between its two channel 
outputs is regarded as a failure, diverting control to the second section. A 
difference detected between its monitor and active channels is regarded as a 
second failure and causes the gimbal to center for fail-safe. Each of the 
four channels requires an electrical servoamplif ier controlling its torque 
motor input. Two 28-vdc solenoids provide an initial activation function in 
providing supply pressure to the diverting and bypass valves. Position 
feedback is provided by LVDT's operating off the output piston shaft. 

Two main engines and two OMS engines require 16 channels of electronics, 
if dual-section actuators are used for both. 

Two shuttle or biter LRU's containing eight thrust vector control 
channels each will be used on ESS. The LRU design is characterized by 
sealed cases, rigid construction and conduction thermal paths which facilitate 
hard mounting to a heat sink to allow remote locations subjected to severe 
temperature, vibration, and vacuum environments. 

GN&C LRU Characteristics Summary. All GN&C LRU's and their 
significant characteristics are summarized in Table 2.-23. 

GN&C Trade Studies and Performance Analysis 

This section contains detailed analyses in the following areas: 

Guidance and-navigation error analysis 

Phasing analysis 

Other missions 

Synchronous orbit considerations 
Close rendezvous considerations 

These analyses were performed by the IBM Corporation in support of the ESS 
GN&C subsystem. 

Supporting control analyses and studies are covered earlier in Sec- 
tion 2.2. Recovery of GN&C equipment and associated GN&C deorbit 
considerations are covered in Paragraph 2. 38 of this report. Deorbit analysis 
relative to GN&C requirements is covered in Paragraph 2. 3. 3. The ESS 
GN&C subsystem recommended configuration and requirements are based 
on these analyses. 
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Guidance and Navigation (G&N) Error Analysis . A G&N error 
analysis was performed during this study that encompassed both non- 
rendezvous baseline and rendezvous missions. The key issues were to 
determine the navigation and attitude update requirements. 

The first task was to determine if navigation and/or attitude updates 
were necessary and, if so, to determine the best equipment and technique 
to recommend. 

The following data were used in conducting the analysis: 

1. ESS Trajectory 

a. Updated nominal ESS ascent trajectory (MDAC space station 
payload) 

b. Launch azimuth of 40 degrees from KSC 

2. Tracking Coverage 


a. Vehicle state vector updated once every ten second's for the 
total station coverage time (station acquisition at 5 degrees 
elevation). 

b. Manned space flight network (MSFN) 

(1) Existing stations 

(2) Four station networks expected to be operational in the 
1980<s: 

Kennedy Space Center 
Madrid 
Honeysuckle 
Goldstone 

c. Shuttle selected multilateration beacon locations are as 
follows: 

Kennedy Space Center, Florida 
Columbus, Mississippi 
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Table 2-23. LRU Characteristics Summary 


LRU 

r 

No. per 
Vehicles 

Functions 

Content of ^ 

Each LRU 

Redundancy 

Functional 

Interfaces 

Weight 
(lb ! 

per 
LRU) 

Volume 

(in. 3 

par 

LRU) 

Power 

(watts 

per 

LRU) 

Remarks 

Four gimbal inertial 
measurement unit 
ilMU ] platform 

3 

Provides Incremental 
measurement of vehicle 
velocity 

Provides vehicle 
attitude information. 

2 2 DOF gyros 

2 accelerometers (one 
2-axis, one 1-axis] 

3 accelerometer 
rebalance 

electronic s < 

4 gimbal drive 
electronics 

1 A/D convertor 

2 temperature control 
electronics 

1 ACT unit 

FO/FS 

V chi lie 
motion 

Data 

management 
processor 
IMU power 
supply 

25 

785 

70 

Requires alignment to within 
30 ari -minutes of vehirle 
axes. 

IMl power supply 

3 

Accepts ac and dc power 
from vehicle bus and 
converts it to type and 
levels required by 1MU 
platform 

2 heater power supply 

1 synchrd power supply 
1 fan power supply 

3 regulated dc power 
supplies 

FO/FS 

IMU 

platform 

Vehicle 
power bus 

22 

600 

50 


Body rate sensor 
tpitch) 

3 

Provides body rate data 
at selected vehicle 
station. 

1 rate sensor 
1 exciter /oscillator 
1 signal conditioner 
1 *15 vdc regulated 
power supply 
1 ACT unit 

FO/FS 

Vehicle 

motion 

Data 

management 

processor 

2. 2 

45 

3 9 

Utilizes (■(*1102 vibrating 
wire rate sensors 

Bodv rate sensor 
t\aw) 

3 

- 

- 

* 

- 

- 

- 

- 

“ 

l>od\ rate sensor 
< roll) 

3 

- 

J 


- 

' 

- 

■ 

“ 

*1 C gimbal servo 
nnver unit 

2 

Provides proportional 
control of clcctro- 
hydrauiio actuator valves 
for main/OMS engine 
gimbal actuators. 

8 T \ C servo loop j 

electronic channels 
1 bias supply , 

1 ACT unit 


Data 

management 

processor 

Main/OMS 

engine 

gimbal drive 
and foudback 

6 5 

188 

18 

Drives two aitualors per 
. 1 x 1 s on each of two l.S* 5 
main or OMS engines. 

Amtudc/transiation 
uriver unu, four jet 

4 

Provides control of 
valve solenoids (H 
0^) and provides 
ignition control. 

4 ON-OFF driver 
stages 

4 transient suppres- 
sion circuits 
4 ignition circuits 
4 bias supplies 
3 ACT units 

FO/FS 

driver stage and 
ignition arc 
single. 

Jet valve 
solenoids 

Jet ignition 
exciters 

OMS engine 
valve 
soleuoi ds 

14 

3 90 

12 

.Stand hi power, .mu.il ft line 
higher, 180 walls per tel. 






OMS engine 

ignition 

exciters 










Data 

management 

processor 





Attitude /translation 
driver unit, two jet 

1 

Provides control of 
valve solenoids (H 2 / 
O 2 ) and provides 
ignition control. 

2 ON-OFF driver 
stages 

2 transient suppres- 
sion circuits 
2 ignition circuits 
2 bias supplies 
2 ACT units 

F/O dual, except 
driver stage and 
ignition are single 

Jet valve' 
solenoids 

Jet ignition 
exciters 

Data 

management 

processor 

8. A 

238 








Bergstrom AFB, Texas 

Biggs AFB, Texas 

Darwin, Au s tr alia 

N Djili, Congo 

Honolulu AFB, Hawaii 

Nandi Inti. , Fiji Island 

La Lontana, New Caldonia 

Ramey AFB, Puerto Rico 

Kadena AFB, Ryoko Island (Okinawa) 

San Nicolas Island Coif. , California 

d. Tracking data relay satellites (TDRS). Three satellites at 
synchronous altitude over longitudes 16 0 W, 88°W, and 180°. 
This configuration allows all three satellites to communicate 
directly with ground stations in the continental USA. 

3. On-Board Navigation Hardware Considered 


a. IMU (Kearfott KT-70). Selected reference platform for NR 
Space Shuttle Phase B studies. 

b. Star Tracker (ITT Aerobee 150A). Selected reference star 
tracker for NR Space Shuttle Phase B studies. 

c. RF Beacon (CUBIC DM 100). Selected reference tracker for 
NR Space Shuttle Phase B studies. 

4. Analytical Tools 


a. ANS. The autonomous navigation simulation program simulates 
autonomous navigation along a Keplerian orbit as performed by 
a Kalman filter , using data selected combinations of horizon 
sensor, star tracker, landmark tracking telescope, radar 
altimeter, range finder (laser), and ground station tracking 
measurements. This program effectively models the shuttle 
navigation routine. 
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IPEP. The inertial platform error program utilizes the 
normalized integral technique developed by George R. Pitman, 
(author of Inertial Guidance) to propagate platform hardware 
errors during boost phases of flight. 

c. MIRCUS. This program is a six-demensional orbital simulator 
that generates orbital trajectories very accurately out to 
24 hours ground elapsed time. The simulation is in single 
precision and utilizes a Runge Cutta third-order integration 
routine, a PRA 63 reference atmospheric model, and a grava- 
tional potential model of an oblate spheroid. The program 
calculates and prints the orbital trajectory parameters, 
tracking station look angles, and station acquisition and loss 
times . 

Nonrendezvous Mission G&N Error Analysis. The following missions 
have been consider- ed; 

Baseline mission. Ascent to 66- by 100-nm orbit, parking orbit 
circularization burn (100-nm circular parking orbit phasing and 
navigation updates, 100- by 270-nm transfer burn, and 270-nm cir- 
cular injection burn). 


Direct ascent . Ascent to 66- by 270-nm orbit and 270 nm circular 
injection burn. 

Baseline Mission . The organization of this section is as follows: 
Boost to 66- by 100-nm orbit 
Parking orbit insertion (100-nm circular) 

Parking orbit coast phase analysis 
Mul til ate ration updates 
MSFN updates 
TDRS updates 
Transfer to 270-nm orbit 
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a. Ascent to 66- by 100-Nautical Mile Orbit. The ESS ascent 

trajectory obtained from NR was used as an input to the IPEP 
program along with the reference platform errors (Rearfott 
KT-70) in order to conduct the boost error analysis. The 
platform errors used were (1) azimuth alignment — 360 seconds 
(1 cr) and (2) drift — 0. 02 degree /hour (lir). 

The results of the ascent navigation error analysis, which used 
as inertial platform only, is as follows (with shuttle require- 
ments shown for comparison): 


Parameter 

Simulation Results (N) 
at 0. 66 by 100- nm 
Orbit Insertion (1 o') 

Shuttle 

Requirement (1 o') 


! Radial (R) 

0.21 nm 

0. 5 nm 

Position 

Tangential (T) 

0. 3 nm 

Not critical 


. Normal (N) 

1.35 nm 

2. 0 nm 


R 

10. 0 fps 

25 fps 

Velocity 

T 

4. 26 fps 

6 fps 


N 

47. 5 fps 

75 fps 


The large normal (cross-range) position and velocity errors 
are due principally to the IMU azimuth alignment technique 
commonly referred to as "gyro compassing. " This technique is 
the same one proposed for the shuttle. 

b. Parking Orbit Insertion (100-Nautical Mile Circular) . The 

inertial platform errors at 66- by 100-nm orbit were propagated 
to parking orbit insertion and the radial (R), tangential (T), and 
normal (N) errors were as follows: 


Parameter 

Simulation Results (1 cr) 


R 

1. 47 nm 

Position 

_ i 

Error 

T 

6. 5 nm 


In 

1.35 nm 


'r 

3 9.4 fps 

Velocity _ 
Error 

T . 

7. 78 fps 


In 

47. 00 fps 
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Parking Orbit Coast Phase (100 -Nautical Miles Circular). The 
initial state vector uncertainties for the Kalman filter in the 
ANS program. The errors were then propagated through 
15 parking orbit revolutions which encompass the maximum 
possible phasing. Figure 2-111 is a plot of the RSS navigation 
position error when inertial navigation only during parking 
orbit phasing is used. 

Figure 2-111 illustrates that using only inertial navigation 
during parking orbit results in very large navigational errors. 

In addition, if the orbit transfer burns were initiated at the 
most opportune time (parking orbit insertion), the propagated 
navigation errors at insertion into 270-nm circular would be in 
excess of 150 nm. Therefore, the conclusion is reached that 
navigation updates are necessary in parking orbit to reduce the 
inertial navigation error at insertion to an acceptable 
magnitude. 

Space Shuttle trade studies have investigated numerous 
autonomous and ground-assisted navigation update techniques. 
Among these are RF beacons (multilate ration), MSFN tracking, 
horizon/star tracker sightings, and manned landmark tracking. 
The trade study results for the shuttle selected the RF beacon 
approach, and it will be considered here along with MSFN and 
TDRS. 

The. ANS -program-was - us'ed' to investigate the navigation update 
accuracies with the following results: 

(1) Multilate ration navigation updates ( 100 -nautical mile 
circular). An analysis of parking orbit navigation accuracy 
was performed by using RF beacons for various navigation 
updates rates. Figure 2-112 depicts the results of that 
analysis, showing that the initial navigation uncertainties 
can be reduced to 0. 05 nm. The rate of navigation 
uncertainty reduction is dependent on the station coverage 
available. The coverage available during parking orbit is 
shown in Table 2-24. The multilateration coverage 
indicates that the steady-state navigation position error 

of 0. 05 nm can be achieved in less than two orbits. 

(2) MSFN navigation updates (100-nautical mile circular) . An 
analysis of parking orbit navigation accuracy was performed 
by using MSFN tracking. Figure 2-113 depicts the results 
of that analysis. 
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Table 2-24. MSFN, Multilateration, and TDRS Tracking Coverage for ESS 
100-NM Parking Orbit (Inclination = 55 Degrees, Azimuth. = 40 Degrees; 

Launch Site = KSC) 


Orbit 

*MSFN (Eight 
Stations) 

**MSFN (Four 
Stations) 

Multilateration 

TDRS 

(percent) 

1 

2 

1 

2 

3-91. 7 

2 

2 

2 

2 

3-91. 7 

3 

3 

1 

• 4 

3-91. 7 

4 

3 

1 

3 

3-91.7 

5 

4 

1 

2 

3-91. 7 

6 

4 

2 

6 

3-91.7 

7 

2 

1 

4 

3-91. 7 

8 

0 

0 

1 

3-91. 7 

9 

1 

o 

1 

3-91. 7 

10 

1 

0 

1 

3-91. 7 

11 

1 

0 

2 

3-91. 7 

12 

2 

0 

3 

3-91.7 

13 

3 

2 

3 

3-91. 7 

14 

3 

2 - 

1 

3-91.7 

^Existing MSFN stations 

**MSFN stations projected for the 1980 time period 
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Figure 2-113. Navigation Position Accuracy Versus Time for MSFN Tracking Updates 
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The figure indicates that a navigational error of 1 nm can 
be achieved in less than two orbits by using all the available 
MSFN tracking stations. For the reduced tracking facilities 
expected to be available for ESS missions, about 
three orbits would be required to achieve the same result. 
By appropriate mission planning, the transfer burn to 
270 nm can be made immediately after a navigation update 
with increased accuracy and in a shorter time. 

(3) Navigation by using tracking and data relay satellite system 
(TDRS) (.100 -nautical mile circular). Concepts of utilizing 
synchronous satellites for tracking and data relay purposes 
have been suggested by Dr. F. O. Vonbun of the Goddard 
Space Flight Center. This TDRS system would employ 
geostationary synchronous spacecraft to take over the 
functions of tracking, command, and relay of -data from 
multiple low earth -or biting satellites to a few centrally 
located ground stations. The satellites would be located to 
allow all three TDRS satellites to communicate directly 
with ground stations in the continental USA. 

The principal advantage of synchronous satellite tracking 
is the increased coverage of low earth-orbiting spacecraft 
obtainable. 

An error analysis study was made by Goddard Space Flight 
Center to determine the ability of a network of three synch- 
ronous satellites to track vehicles in low earth orbit over 
long arcs. Only one TDRS was allowed to track the vehicle 
at a time, switching being done between satellites to give 
better geometry. One proposed system configuration has 
the tracking link origination at the main ground control 
center. The signal from the main ground station is trans- 
mitted to a TDRS, relayed to the vehicle, and then returned 
to the ground station via the same link. 

The assumptions made in the performance of the study 
were present tracking uncertainties, present station 
location uncertainties, and one measurement every 
ten seconds. 
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The 100-nm parking orbit determination uncertainties 
associated with a system of this type are shown'as follows: 


Tracking 
Time j 

(hr) 

Radial 
Component 
of Position 
(ft) 

Position 

(ft) 

Velocity 

(fps) 

2 

1000 

2000 

2. 0 

4 

130 

650 

0. 55 

8 

115 

65 0 

0.7 

12 

82 

850 

0.8 

16 

210 

1800 

1.4 

20 

230 

1500 

1 . 1 

24 

380 

1500 

1 . 1 


The accuracy of this system is comparable to MSFN 
ground station tracking accuracies, but has the added 
benefit of increased coverage. 

- If- the -orbits of 'the'Tow altitude satellite and the three TDRS's 
are solved simultaneously by using a Kalman filter, the 
improved estimates of their orbits will result in an even 
greater TDRS tracking accuracy potential. 

d. Transfer -Burn Phase (100 by 270-Nautical Miles and 

Circularization at 270-Nautical Miles). The transfer burn from 
100-nm parking orbit to 270-nm orbit was assumed to occur 
after approximately 1-1/2 orbits at 100-nm by using MSFN 
navigation updates. 

The selection of one and one -half orbits and MSFN update 
techniques was based on the following rationale: 

(1) "Look ahead" analysis indicated that MSFN navigation 
updates would allow the ESS to meet mission require- 
ments and appears to result in minimum onboard equipment 
for ESS. 
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(2) One and one-half orbits result in a minimum instantaneous 
navigation error. (A greater number of orbits results in 
a lower average error but this average is offset by the 
larger inertial alignment errors encountered). 

The navigation errors before the transfer burn under the above 
conditions are: 


Position 

Navigation Errors (lo-) 

R 

320 ft 

T 

3 70 ft 

N 

360 ft 

Velocity 

R 

0.53 fps 

T 

0. 37 fps 

N 

0. 42 fps 


These errors were used as initial conditions for the 100- to 
270-nm orbital transfer analysis. The results of this analysis 
are shown in Figure 2-114, and the navigation insertion errors 
at 270 nm are shown as follows: 


Parameter 

Navigation 
Errors (1 cr) 
Without 
Update 

Navigation 
Errors (1 tr) 

Tentative 
Navigation Error 
Requirements ( 1 or)* 

Position 




R 

0. 45 nm 

0. 125 nm 

1. 7 nm 

T 

1. 17 nm 

0. 13 nm 

— 

N 

0. 06 nm 

0. 055 nm 

— 

Velocity 




R 

7. 67 fps 

1. 15 fps 

17 fps 

T 

2. 2 fps 

0. 62 fps 

5 fps 

N 

0. 75 fps 

0. 62 fps 

— 

Orbital 




characteristics : 




Apogee /perigee 

2. 15 nm 

0. 58 nm 

— 

Inclination 

0. 0009 deg 

0. 00085 deg 

0. 033 deg 


*Refer to NR ESS Phase A/B Technical Review Brochure 2'1 May 1971. 
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Figure 2-114. Direct Ascent From Parking Orbit to Final Orbit Insertion 
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e. Attitude Update Analysis. IMU misalignment results from 
initial gyrocompassing launch pad alignment errors and from 
constant gyro drift during the mission. The reference IMU 
has the following accuracy (1 tr) requirements: 

Azimuth Alignment - 360 seconds 

Level Alignment - 40 seconds 

Drift - 0. 02 degree per hour. 

The baseline nonrendezvous mission duration depends upon the 
time spent in parking orbit. The parking orbit mission duration 
is primarily dependent on navigation update time and is assured 
to be approximately one and one-half orbits. The IMU mis- 
alignment at this time is in the order of 500 seconds for azimuth 
and 200 seconds for leveling. These misalignment errors would 
result in the 270-nm transfer orbit velocity cutoff errors of less 
than 0. 5 fps. As soon as a navigation update is achieved, the 
effect of this error is minimized since, if necessary, a correc- 
tion burn could be performed. After the transfer has been 
.completed, any burns would involve minimal total Impulse and 
the platform misalignments would essentially introduce no 
error. For these reasons, it was concluded that an attitude 
realignment device such as a star tracker or horizon sensor 
would not be necessary for the baseline mission. 

The direct ascent mission likewise indicates no requirement for 
an attitude update. The mission is short in duration, and only 
the initial misalignment terms dominate (AZIMUTH - 360 sec- 
onds, LEVELING - 40 seconds). These alignment errors 
propagated to the final orbit insertion burn would result in 
velocity cutoff errors of approximately 0. 05 fps, which is an 
order of magnitude less than the baseline mission. 

f. Guidance and Targeting. Analysis has indicated no hardware 
or implementation tradeoffs which should be made to adapt the 
shuttle orbiter guidance and targeting scheme to ESS. Software 
impact is discussed in Paragraph 2. 3. 2, DCM Subsystem. 

2. Direct Ascent Mission to 270 Nautical Miles . The baseline mission 
ESS ascent trajectory was modified to burn eight seconds longer, 
thus achieving a 66- by 270-nm ascent orbit. 
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The IPEP program was used to propagate the. platform errors to 
ascent orbit insertion. The resultant ascent orbit inertial naviga- 
tion errors were then propagated to the 270-nm circular orbit 
insertion by using the ANS program. The RSS position errors for 
inertial navigation only are presented in Figure 2-115. Also seen 
in the figure is the effect of a navigation update just prior to the 
circularization burn at the 270-nm altitude. The navigation errors 
not making use of navigation updates are prohibitive. However, if 
a navigation update using MSFN is performed, then the position 
error immediately is reduced to approximately 1 nm. The following 
listing contains the 1 o' position. and velocity navigation error com- 
ponents at circularization burn cutoff, using a MSFN update. Also 
listed are the or bital characteristics associated. with these errors. 
The resultant orbit with the update has a 1-sigma apogee and perigee 
uncertainty of 2.2 nm (1 cr). Direct ascent navigation errors with 
and without a navigation update are as follows: 


Parameter 

Navigation 
Error (Icr) 
Without a 
Navigation 
Update 

Navigation 
Error (1 tr) 
With a 
Navigation 
Update 

T entative 
Navigation Error 
Requirements (lcr)* 

Position 



• - 

R 

1. 53 nm 

•0.46 nm 

1. 7 nm 

T 

6. 5 nm 

0.61 nm 

— 

N 

1.56 nm 

0. 58 nm 

— 

Velocity 




R 

37 fps 

5.26 fps 

17 fps 

T 

7. 7 fps 

2. 75 fps 

5 fps 

N 

45 fps 

0. 34 fps 

— 

Orbital 

characteristics 




Apogee /perigee 
Inclination 

±0. 92 nm 
±0. 1 deg 

2.2 

0. 00085 deg 

0. 033 deg 


*Refer to NR ESS Phase A/B Technical Review Brochure (21 May 1971). 
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A tracking system error analysis was made by Goddard to determine 
the capability of a .TDRS tracking network to meet the short-arc 
tracking objectives such as would occur for direct ascent missions 
to 270 nm. It was found that radial position, radial velocity, and 
tangential velocity uncertainties could be reduced to 1000 feet ( 1 cr) , 

2. 0 fps {1 a), and 1. 0 fps (1 <r), respectively. 

3. Summary and Recommendations f or Nonrendezvous Mission, G&N 
Error Analysis . Baseline mission points are as follows: 

a. Navigation updates in 100-nm parking orbit are required. 

b. 'Navigation update aids the following: 

(1) Multilateration — meets accuracy requirements but adds 
o'n- board complexity. 

(2) MSFN (four stations) — meets accuracy requirements and 
minimizes on-board complexity. 

(3) TDRS — looks attractive mainly because of increased 

coverage. Additional detailed analysis is recommended 
for Phase C study. MSFN technique is recommended, 
the conclusion based on the fact that it can meet the 
accuracy requirements and that it minimizes on-board 
equipment requirements.. - - - - 

c. At 100-nm parking orbit, less than two revolutions, are needed 
for navigation updates. 

d. Executing the transfer burn from 100-nm to 270-nm, immedi- 
ately after a navigation update is obtained, improves accuracy 
and reduces mission time. 

e. Attitude reference updates do not significantly improve 
insertion accuracy and therefore are not recommended. 

Direct ascent mission points are as follows: 

a. A navigation update must be obtained just prior to circularizing 
at 270-nm to meet mission performance requirements. 

b. Orbit insertion cannot be performed as accurately as in the 
baseline mission. 
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Rendezvous Mission G&N Error Analysis . The boost and parking orbit 
insertion phases of the rendezvous mission are identical to the baseline 
nonrendezvous mission described in the previous sections. Therefore, the 
error analysis is the same. The error analysis for the transfer to 260 nm 
and the terminal rendezvous phases of the mission are presented in this 
section. 

One and one-half revolutions of phasing in the 100 nm parking orbit 
are used in this analysis. 

1 . Orbit Transfer (100 to 260 Natucial Miles) and Terminal Rendezvous 
Phase, Initiation is assumed to occur one and one-half revolutions 
after parking orbit insertion. 

a. Multilateration navigation updates. The results of the orbital 
transfer and terminal rendezvous phase navigation error analysis 
using multilateration updates are shown in Figure 2-116. The 
figure indicates navigation accuracies achievable through use of 
inertial navigation only, inertial plus star tracker alignment, 
inertial with multilateration updates, and inertial with attitude 
alignment and navigation updates. 

The inertial-only navigation errors grow rapidly to an unaccepta- 
ble magnitude of 14 nm at insertion into the final 270-nm orbit. 

If a navigation update is performed during terminal phase 
rendezvous, over the Hawaii Station, the navigation error is 
reduced to approximately 3 nm (3 o'), a figure well within the 
rendezvous requirement of 11 ± 10 nm (3 cr). Therefore, the 
conclusion to be drawn is that the multilateration technique for 
obtaining navigation updates is acceptable. 

b. MSFN navigation updates. The results of orbital transfer and 
terminal phase navigation error analysis through use of the 
produced MSFN tracking network are shown in Figure 2-117. 
Again the figure shows the accuracies attainable with different 
navigation schemes. 

The inertial only case with no updates is again clearly shown 
to be unacceptable. However, if a navigation update is obtained 
during the terminal rendezvous phase, the errors are reduced to 
approximately a 6 nm (3 <r) position error which is within 
± 10 nm (3 o') rendezvous requirement. 
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The dotted curve in Figure 2-117 emphasizes the sensitivity of 
position errors to the number of navigation updates obtained. 

For this case, a total of three updates were obtained: one during 
the transfer burn from 100 to 260 nm; one during the coast 
period at 260 nm; and one during the terminal rendezvous phase. 

c. TDRS navigation updates. The TDRS results given in the 

previous section of nonrendezvous missions applies also to the 
rendezvous mission. Again, the main advantage in the use of 
TDRS is the increased coverage, which allows more opportunities 
for obtaining navigation updates. 

2. Attitude Update Analysis . Figures 2-116 and 2-117 in the previous 
section show the terminal phase navigation errors by using multi- 
lateration and MSFN tracking updates, respectively. Both figures 
indicate that IMU with attitude update only will not achieve the 
desired performance requirements. When navigation updates during 
the terminal phase are performed with and without alignments, the 
performance differential is negligible. Therefore, the results of the 
orbit transfer and rendezvous phase navigation error analysis 
indicate that star tracker alignment will not be necessary. 

3. Guidance and Targeting . The rendezvous mission imposes no unique 
guidance and targeting requirements. 

4. Summary and Recommendations of Rendezvous Mis sion -G&N' Error ' 
Analysis . T he following points are listed: 

a. To meet the rendezvous accuracy requirement, the ESS naviga- 
tion subsystem will require navigation updates during the 
parking orbit and the terminal phase rendezvous. 

b. Navigation update techniques are as follows: 

(1) Multilateration ~ meets accuracy requirements. 

(2) MSFN (four stations) — meets accuracy requirements and 
minimizes on-board complexity. 

(3) TDRS — looks attractive mainly because of increased 
coverage. Additional detailed analysis is recommended 
for Phase C study. 
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c. The MSFN technique recommended is based upon the meeting 
of accuracy requirements and the requiring of less on-board 
equipment. 

d. Attitude updates do not significantly improve rendezvous 
accuracy and, therefore, are not recommended. 

Phasing Requirements Analysis. In order to launch into a given orbit, 
the launch must take place when the launch site is in the orbit plane — if 
there is not to be a plane change. There are (usually) two such launch 
opportunities per day, one having a launch azimuth less than 90 degrees 
(north launch) and the other having a launch azimuth greater than 90 degrees 
(south launch). Because the time of launch is determined by the transit of 
the orbit plane, the relative phasing of the target vehicle and the launch 
vehicle cannot be controlled, and a wait in a phasing orbit is required. 

When the transfer maneuver from the 100-nm phasing orbit to a target 
in a 270-nm orbit is initiated, the rendezvous location is determined in both 
space and time. The transfer maneuver is. not initiated until the target is in 
the proper position to arrive at the rendezvous point at the same time. The 
wait time in the phasing orbit depends on the initial angle between ESS and 
target, which is arbitrary, and on the angular rates of the two orbits. For 
the nominal conditions, the angular rates are 0.001187 rad/sec for the 
100-nm orbit and 0. 001107 rad/sec for the 270-nm orbit. The worst case 
is in prospect when the target vehicle would arrive just behind the rendezvous 
point; then the ESS in the inner orbit must catch up a full 3 60 degrees — a 
maneuver which requires 21.66 hours. 

As the ESS, relative to the target in the outer orbit, advances in phase, 
the time to catch up decreases linearly until it reaches zero and then jumps 
to the maximum again. 

The phasing required at successive launch opportunities (launch from 
KSC into the 100-nm orbit) is shifted by successive multiples of the daily 
difference. The worst case for a series occurs when the first launch 
opportunity required 360 degrees of phasing. 

For the baseline mission, the interval between launch opportunities is 
nearly an exact multiple of the orbit period at the nominal altitude and inclina- 
tion. The ratio follows: 

pseudoday = 85127 = gg5 
orbit period 5 677 

This computation means that a delay in launching has small effect on the 
phasing time. 
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The conditions are illustrated inFigures 2-118 and 2-119. Figure 2-118 
shows a plot of phasing time (in the 100-nm orbit) versus launch time for 
both the north and south launches. With the position of the target in the 
270-nm orbit arbitrary, the worst case phasing time is 21. 66 hours for a 
north-only launch or a south-only launch. Figure 2-119 is a composite of 
Figure 2-118, presently both the north and south launch opportunities. 

Two launch opportunities per day can effect a worst-case phasing of 
14. 60 hours. 

Figure 2-120 shows the phasing time as a function of delay in launch 
for the nominal target orbit (270 nm and i = 55 degrees) and some variations 
of the target orbit. Noteworthy is the extraordinary flatness of the nominal 
cases. A change in altitude — up or down ~ produces an increased slope. 

A decrease in inclination produces longer than nominal phasing times for the 
two -opportunities -per -day case. 

Figure 2-121 shows the phasing time required for the 260-nm, 

31. 5-degree orbit and some variations of this orbit. The worst-case phasing 
time, in terms of one launch opportunity per day is 23 hours. Two launch 
opportunities per day reduce the time to 20 hours. An increase of 1 degree 
in inclination (i = 3 2.5), two launch opportunities per day, gives a worst- case 
phasing of only 13 hours. 

Figure 2-122 provides a plot or orbital altitude versus inclination for 
zero-phase change orbits. Two of the four ESS 'missions covered in this 
study have target orbits the parameters .of which- a-re very ■close to those of 
a zero-phase change orbit. The altitude for a 55-degree inclination zero- 
phase change orbit and for a 31.5-degree inclination zero-phase change 
orbit are 269. 14-nm and 254. 07-nm, respectively. 

Zero-phase change orbits are very sensitive to small effects. An 
error analysis was made: the following two approaches to utilizing these 
zero -phase change orbits are considered feasible. 

Regarding the first approach, suitably phasing the initial launch (e. g. , 
placing a space station in orbit) can keep the phasing time required for 
subsequent launches (e, g. , logistic supply missions to the space station) 
short for a long time interval. In using this approach in controlling the 
phasing time, the initial launch should include the maximum phasing time. 

The subsequent launch to rendezvous missions will then have a phasing time 
which linearly decreases to zero and then jumps to the maximum time of 
14. 6 hours (or possible 7. 06 hours) as a function of the data after the initial 
launch. 
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Figure 2-118. Phasing Time Required, Each Launch Opportunity 


131. 76 DAYS — 
— 194.70 DAYS 



LAUNCH TIME (DAYS) 


\ 


Figure 2-119. Phasing, Time Required, Composite Using Both 

Launch Opportunities 



z-o^i-u as 

£6Z“Z 

PHASING TIME, WORST CASE, HOURS 




-0*1 -u as 

f6z~z 

PHASING TIME, WORST CASE, HOURS 


LEGEND: 


-ORBIT ALTITUDE (nmi) 

/ — ORBIT INCLINATION (DEG) 

/ ^-LAUNCH OPPORTUNITIES PER DAY 

31.5,1 



260, 32.5, 1 

260, 31. 5, 1 
262, 32.5, 1 

^262, 31.5,1 
260, 31.5, 2 

262, 31. 5, 2 


RNS SUPPLY MISSION 

NOMINAL IS 266 nmi ALTITUDE, i 
REGRESSION EFFECT INCLUDED 
PHASING ORBIT IS AT 100 nmi 


= 31.5 


260, 32.5, 2 


•262, 

32.5, 

2 





tv 

tv 

•v£> 

Vi 


Cfi 

d 

-J 


I 

t— * 

0 

1 

tv 



PSEUDO DAY 
ORBIT PERIOD 


ALTITUDE FOR ZERO PHASE 
CHANGE AT 55 DEGREES 
INCLINATION IS 269. 14 nmi 



Figure 2-122, Orbits for Zero-Phase Change 



o 

This procedure may be further explained by using the baseline mission 
and by referring to Figure 2-119. If the initial launch is a north launch and 
is performed with no phasing, the next launch opportunity will require 
7. 06 hours of phasing for rendezvous. If the initial launch is a south launch, 
then 14. 60 hours could be required. The reason is that n (ratio of launch 
opportunity to orbit period) is slightly less than an integer, and thus the 
target would be just behind the desired position in orbit for rendezvous. 
Providing phasing for the initial launch in the 100-nm orbit will move the 
target forward; thus less phasing time will be required for subsequent 
missions. Each hour of phasing in the initial luanch will provide about 
nine following days of favorable conditions for subsequent rendezvous 
missions. 

The second approach involves moving the target orbits either to the 
zero-phase change orbits or away from them. 

A target (space station) in a zero-phase-change orbit will provide 
fixed phasing for rendezvous missions. Station keeping is required for the 
target to remain in a zero -phase -change orbit; however, the station keeping 
orbit requirement is not severe. For rendezvous mission, if ten minutes of 
phasing in the nominal case are allowed, a ± 5-minute variation in the nominal 
phasing would correct for ±90 nm of target position error. 

Moving the orbital altitude away (a few nm) from the zero-phase - 
change altitude reduces the period between launch opportunities for a pre- 
selected maximum phasing time and increases the phasing time required. 

This condition is illustrated in Figure 2-123. 

For, an orbit of 5.5 degrees of inclination and with a phasing time of less 
than five hours and a launch opportunity within seven days, the usable altitude 
bands nearest the nominal 270-nm altitude are 240 to 255 nm and 2 90 to 
320 nm. 

Other Missions . Two other missions were given brief consideration: 

(1) synchronous -orbit mission and (2) close-rendezvous mission in order to 
identify potential additional system and operational requirements. These 
are discussed in the following paragraphs. 

Synchronous Orbit Considerations. Since the advantage of placing a 
satellite in synchronous orbit is that.it will remain fixed (with some small 
stationkeeping maneuvers) in earth coorindates, it is assumed that some 
pre-selected position in orbit is required. A trajectory for a typical 
equatorial synchronous-orbit mission is illustrated in Figure 2-124. 
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Figure 2-124. Synchronous Orbit Trajectory 





The mission phases are as 'follows: 

1. Boost from KSC to low altitude phasing orbit (i. e. , 100-nm 
circular) 

2. Coast in phasing orbit (phase and navigation updates) 

3. Performance of Hohmann transfer from phasing orbit to synchronou 
altitude {19,360 nm) 

The Hohmann transfer will begin and end on the line of the nodes as 
illustrated in Figure 2-124. Time in the phasing orbit is dependent upon 
target station location. The plane change velocity change (to achieve an 
equatorial orbit plane) is normally divided between the two burns for the 
Hohmann transfer. Initial lift-off and phasing altitude are selected to limit 
the phasing time to a desired value. Assuming that a minimum of two orbits 
in the 100-nm phasing orbit are required to accomplish sufficient navigation 
updates, mission durations (from lift-off until arrival at or near the desired 
synchronous orbit station) will vary from- approximately 8.3 hours at 
17. 4 hours. 

Extrapolating from the 270-nm rendezvous mission studies, it is 
evident that not only will multiple navigation updates be required, but the 
inertial attitude reference will also require updating because of the large 
velocity changes required to achieve synchronous orbit. 

If the synchronous orbit mission were required, a star tracker of 
the type recommended for the shuttle orbiter would be added to the present 
system to accomplish stellar updating of the inertial attitude reference. 

This instrument is a strapped-down, dual-mode star tracker procured from 
ITT. It employs a photomultiplier tube and has an 8-degree field of view. 
Attitude reference updating would be accomplished in the 100-nm parking 
orbit and possibly during ascent to synchronous altitude prior to circulariza- 
tion and plane correction burns. 

Deorbiting of the ESS from synchronous orbit would be very difficult - 
if not impossible because of the large velocity change required (approximately 
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4900 fps). Wherever the payload to synchronous orbit is compatible with 
such a procedure, it could be advantageous to leave the spent ESS attached 
to the payload during payload operations. 

Another consideration for ESS disposal from synchronous orbit 
might be to inject the spent ESS into a solar orbit. Here, the velocity change 
requirements would also be excessive, however (AV > 400 fps). 


Close Rendezvous Considerations. Extrapolation from the 270-nm 
rendezvous mission studies indicates that achievement of a very close 
rendezvous (i. e. , 2 ± 1 nm) would require some combination of range to 
target, range rate to target, and/or relative angular data. This conclusion 
implies compatible ranging equipment on both vehicles as a minimum require- 
ment and possibly the use of a star tracker (in conjunction with a compatible 
light on the target) or laser radar for angular information. 


Since the 11 ± 10 nm distance used for a baseline rendezvous mission 
is considered adequate, the additional on-board hardware and software 
complexity, the decrease in reliability, and the associated increase in 
development and qualification requirements are not considered as warranted 
to achieve the relatively small improvement in performance. 
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2. 3. 2 Data and Control Management 



The baseline data and control management (DCM) subsystem selected 
for the ESS provides a centralized, integrated computation capability with a 
standard interface to each subsystem through an operational data bus. The 
system includes the onboard hardware and software capability required to 
accomplish the ESS mission. 

Commonality between the shuttle and ESS will be attained by utilizing 
DCM components and software developed for the shuttle program which meet 
the requirements of the ESS program. 

The primary requirements imposed upon the DCM subsystem by the 
ESS are to provide the means of integrating, managing, and controlling the 
ESS vehicle. These requirements encompass the mechanization required to 
perform the computerized functions utilized in vehicle sequencing and control, 
subsystem configuration management, and data management. This section 
discusses the design requirements and provides a functional description of 
the DCM subsystem. 

DCM Requirements 

The DCM shall be capable of exercising control over the functions of 
(l) guidance, navigation and flight control, (2) vehicle sequencing and control, 
(3) subsystem redundancy management, and (4) data management. 

The major ground rules and assumptions applicable to the DCM sub- 
system are: 

1. Use shuttle hardware and software when possible. 

2. The FO/FS requirement dictates that a fourth computer be supplied 
to provide 100-percent capability of detecting and recovering from 
a second computer failure. 

3. All data interfaces external to the DCM subsystem are with the 
ACT (acquisition, control, and test) units. 

4. The ACT units will be capable of accepting 28-vdc discrete inputs 
from other vehicle subsystems. 

Guidance, Navigation, and Flight Control. The DCM subsystem shall 
be able to obtain GN&C subsystem velocity and attitude data, provide for 
calculations of all necessary equations (algorithms) to establish position data. 
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and from tne data provide outputs to the vehicle flight control subsystem to 
maintain vehicle trajectory during mission boost phase and attitude control 
during on-orbit operations. 

Vehicle Sequencing and Control. The DCM subsystem shall provide the 
capability of controlling the ESS subsystem to accomplish the following 
mission-oriented operations. 

Prelaunch operations 

Conduct subsystem readiness checks 

Perform final "T" timed sequence events in preparation for 
launch 

Provide information on ESS status to booster and ground 
Perform subsystem statusing 
Booster boost phase 

Verify final engine pre start readiness 

Provide information on ESS status to booster and ground 

Maintain mission sequence 

Perform subsystem status testing 

ESS/booster separation through main engine cutoff 

Initiate main engine start function when booster permits are 
satisfied 

Support separation 

Initiate main engine and supporting subsystems performance 
mo nito ring 

Maintain mission sequence 
Provide information on ESS status to ground 
ESS safing 

Initiate safing commands for main propellant tanks 
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Data Management. The DCM subsystem shall contain the software/ 
hardware capability for acquisition, processing, and distribution of ESS 
vehicle data. These data consist of the following: 

Vehicle sequence status data 

Vehicle subsystem performance monitoring data 

Uplink data 

Vehicle Sequence Status Data. The DCM subsystem shall process and 
distribute to the ground and booster real time ESS vehicle status during 
boost phase. This status will include vehicle attitude, position, flight path 
and mode data, and any performance monitoring data which could cause an 
ESS/booster alternate sequence. 

Vehicle Subsystem Performance Monitoring. The DCM subsystem 
shall process and store all ESS subsystem malfunction and configuration data. 
These data will consist of, as a minimum, all functional path failures and 
will include results of any diagnostics performed. The data to be recorded 
will include the following: 

Measurement ID and value 

Tolerance of the measurement 

Time of occurrence 

Correlation measurement data 

Critical boost phase data will be transmitted real time as described under the 
vehicle sequence status data requirements above. Transmission of non- 
critical data to the ground will be accomplished only upon request through 
the uplink during quiescent vehicle modes. 

Uplink Data. The DCM subsystem shall receive and process uplink 
data from any of the following sources: 

Booster during mated boost 

Ground during all mission phases 

Orbiter during on-orbit operations 

These .data will be in the form of guidance and navigation updates, alternate 
sequence commands, attitude updates, and request for vehicle status. 
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Orbit insertion 



Control OMS engine burn to obtain required delta V 
Maintain vehicle attitude 
Maintain vehicle performance monitoring 
Provide information on ESS status to ground 
Maintain mission sequence of events 
On-orbit operations 

Maintain attitude with attitude control propulsion system (ACPS) 

Maintain vehicle performance monitoring 

Provide information on ESS status to ground and orbiter 

Safe the vehicle for orbiter rendezvous avionics recovery and 
docking as required 

Separate ESS from the payload 

Transmit all central processing unit (CPU) core data to ground 
De -orbit 

Perform ESS preparations for de-orbit 

The DCM subsystem shall provide for all vehicle mission contingencies 
which are required to implement the FO/FS requirements. For example, 
vehicle stability requirements during one -main-engine -out operations differ 
from normal and must be preprogrammed in the DCM software. 

Subsystem Redundancy Management. The DCM subsystem shall be 
capable of performing checkout and fault isolation for all individual ESS 
subsystems. It shall be able to detect all functional path failures, including 
those internal to the DCM, and implement the available redundancy to 
continue the ESS missions. 
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Software, The DCM subsystem shall contain the software required to 
implement the ESS operational requirements of; 

Guidance and navigation 

Flight control 

Subsystem control 

Uplink data 

Subsystem configuration management 

Vehicle data management 

Checkout 

Recovery safing 

Vehicle Timing . The DCM subsystem shall provide all timing functions 
required by the ESS subsystems. 

ESS Versus Shuttle Computer Redundancy Criteria. The shuttle pro- 
gram has a redundancy requirement of FO/FS for all systems except for 
the DCM system which is designed for a redundancy level of FO /FO/FS. 

The shuttle program meets this requirement for the DCM system by imple- 
menting a computer complex with four central processing units sharing 
12 modules of memory. This configuration provides the shuttle with 100 per- 
cent coverage for failure detection and fault isolation during the first two 
redundancy levels of FO/FO and a degraded coverage (approximately 98 per- 
center the redundancy level of FS. This degraded FS capability, when 
considered with the capability provided by the man in the loop and the hard- 
wire backup capabilities provided in the shuttle design, satisfies the require- 
ment of the shuttle program. 

, In considering the ESS requirement of FO/FS, it is necessary to 
evaluate the criticality placed on the fail-safe condition. The driving factors 
in establishing the FS requirements are; 

1. Autonomous system due to no man- in-the -loop. 

2. Normal ESS payload will be a high cost one-of-a-kind item. 

3. No possibility of salvaging the payload with ESS failure to attain 
orbit. 
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4. The additional cost of the fourth computer is minimized by recovery 
of avionics. 

For these reasons, in addition to the fact that there are no hardwire backup 
systems, it becomes necessary for the ESS DCM subsystem to be fully oper- 
ational through two failures (FO/FS). This generates the need for the ESS 
DCM subsystem to maintain 100-percent coverage for both levels of redun- 
dancy provided to satisfy the FO/FS program requirement. This is accom- 
plished by using the shuttle DCM computer complex of 4 central processors 
sharing 12 memory modules. When the recovery of ESS avionics is factored 
into the decision it becomes the most cost-effective approach for attaining 
the confidence level required for the ESS mission. 

Subsystem Description 

The DCM subsystem includes hardware and software required for ESS 
vehicle sequencing; performance monitoring; redundancy management; sub- 
system checkout; and data acquisition, processing, and distribution through- 
out the ESS vehicle. This subsystem is composed of three major elements: 

(1) data management computer (DMC), (2) data bus distribution components, 
and (3) software. Figure 2-125 is the DCM Subsystem Schematic. 

The DMC provides the primary central vehicle intelligence for control 
of subsystems and associated data. The DMC complex consists of four cen- 
tral processing units- (CPU), four input/output units (I/O's), and twelve main 
memory storage units (MSU's) of 8,192 words each. The dat a bu s element 
provides the vehicle communication link between the central computer and 
the various vehicle subsystems, the booster crew display, and ground sta- 
tions via telemeter or hardwire for ground monitor and control. The data 
bus consists of four twisted shielded pair transmission lines; acquisition, 
control and test (ACT) subsystem interface units; and transmission line/ACT 
interface line coupling units (LCU). The software element includes all 
computer programs for checkout and flight sequencing of the ESS vehicle 
subsystems. 

This configuration for the DCM subsystem was selected to meet the 
requirements of detecting, isolating, and recovering from two independent 
single point failures. After two failures the subsystem is fully operational, 
which is required for safe vehicle operations. This is referred to as fail 
operational, fail safe (FO/FS). 

Subsystem Operational Functions. The DCM provides the processing 
and computing functions required for operation and checkout of the ESS 
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onboard systems. To accomplish these functions, the following capabilities 
are required: 

1. Configuration and Sequence Control. This function will provide 
control of subsystem configuration and sequencing of subsystem 
operations and modes for both normal and contingent operations. 

In abnormal cases, initiation will be implemented by uplink data 
from the booster or ground, but under normal conditions, all 
operations will be automatically initiated by preprogrammed 
vehicle mission sequences or as a result of the checkout and fault 
isolation function. 

2. Guidance and Navigation. This function will process the appro- 
priate guidance and navigation algorithms for each mission phase. 

3. Flight Control. This function receives data from the guidance and 
navigation function and processes it to generate appropriate 
vehicle maneuvering commands to the vehicle control subsystems. 

4. Data Storage. This function provides for storage of flight and 
ground programs , critical flight data, system performance data, 
and vehicle configuration status. 

5. Data Acquisition and Distribution. This function provides for the 
intercommunication of measurements, subsystem outputs and con- 
trol signals between the DCM and other vehicle subsystem 
elements. 

6. Checkout and Fault Isolation. This function will maintain con- 
tinued monitoring of vehicle subsystem performance. It shall 
determine the subsystem functional status and in the event of a 
failure, shall activate the redundant functional path for continued 
subsystem operation. 

7. Self-Test. This function shall provide verification of proper DCM 
operation and initiate system reconfiguration when required. 

8. Timing. The CPU will provide the timing for the ESS mission. 
Although the timing may drift slightly (4. 3 seconds maximum) for 
the 24-hour mission, no time -dependent GN&C, functions have been 
found critical to date. The navigation updates provided by the 
ground would aid in compensating for any errors. Therefore, the 
CPU timing will suffice for the ESS missions. 
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Basic Operation. The DCM subsystem will operate in a two-computer 
synchronized mode with both computers performing functions simultaneously 
and cross-checking calculations prior to transmitting data to the ESS subsys- 
tems. One computer will be considered prime while the other computer is 
considered the checker. Both computers will input data via the data bus, 
utilizing the same serial channels. Each computer will have access to five 
modules (8, 192 word per module) of dedicated memory. All computer pro- 
gram instructions will reside in protected memory locations, and all com- 
puter variable data will reside in unprotected memory. (Protected memory 
is defined as "Read-only memory" while unprotected memory is defined as 
"Read and write memory. " ) All unused memory will be assigned as pro- 
tected memory to preclude insertion of data erroneously. If the computer 
attempts to address unused memory it is operating in error. If any program 
attempts to write in protected memory, the computer will enter a failed 
state. Appropriate diagnostic routines will be executed to determine the 
cause of the failure and provide for reconfiguration of the failed element. 

Each computer will contain a dedicated input/output (I/O) with a self- 
contained bus control unit. Control of the I/O and bus control unit will be 
provided by the control processor. The software will be assigned individual 
jobs. The I/O (ACT and bus control unit) function will be scheduled in the 
basic time-allotted job. The I/O will input data requested for the next time 
slot, and output data from the present time slot. The I/O structure will 
vary and is a function of the job scheduling. In fetching data from the ACT's, 
all data from an individual ACT will be assessed instead of individual sets 
of data per ACT. 

In transmitting data to the subsystems, the CPU will identify data in 
memory to be transmitted by the data bus, identify the data bus to be used, 
and initiate the outputing of data. The I/O section will output data to the 
data bus independely of the CPU once the operation has begun. Data will be 
placed on the data bus in a serial pulse code modulated non-return to zero 
format at a one-megabit-per -second (MBPS) rate. The first 9 bits of data 
will contain the ACT unit address with one bit for status information. All 
additional information associated with the addressed ACT unit will be in 
9-bit bytes with 8 bits of information and one bit for parity check. The ACT 
shall, as a minimum, respond to each command with a message containing 
the ACT address and status. If the command message was a request for 
data, the data will be contained in a variable number of bytes following the 
ACT address byte (Figure 2- 126). 

When the command message is an instruction to issue a particular 
subsystem control stimuli, the ACT will decode the instruction, set up its 
output demultiplexer and issue the stimuli. The output stimuli will, in 
addition to going to the subsystem, be wrapped around and fed back into an 
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input channel on the ACT unit. The computer will interrogate this ACT unit 
and verify that the proper command was issued and that no unscheduled 
event occurred. The computer will continue to monitor this functionally 
operational parameter to verify proper system response to the command. If 
the response does not occur, the DCM subsystem will initiate action to 
determine the cause and perform those actions required to continue system 
operation. 

The DCM subsystem will provide the information and control neces- 
sary for the telemetry subsystem to transmit data to the ground. The DCM 
will load the telemetry system ACT /select buffer memory with the ACT 
addresses of the desired data. The defined data will be retrieved each time 
it appears on the data bus and be continuously and automatically transmitted 
until the ACT/select buffer is instructed to alter the particular measurement 
being transmitted. 

The DCM will normally operate by the flight program, but the system 
contains the capability to be updated by the uplink of the communication sub- 
system. The capability and control provided by this function will be limited 
to updating navigation information, initiation of the deorbit sequence, request 
for ESS status and limited command sequencing. 

DCM Performance Analysis 

ESS Deltas to Shuttle DCM Hardware. The following are the deltas to 
the space shuttle baseline DCM configuration dictated by ESS requirements. 

In general, the ESS will use the shuttle hardware (and software) without 
modifications. 

Redundancy Reduction. The FO/FO/FS (for crew survival) redundancy 
requirement for the Space Shuttle has been reduced to F/O FS for the ESS 
vehicle. The following are the redundancy levels for the ESS as compared to 
the Space Shuttle. 

Four CPU/IO units required (no reduction) 

Twelve 8K main storage modules required (no reduction) 

No mass storage units required (reduction of four) 

Four data bus lines required (reduction of one) 

The reduction of redundancy will have little or no impact on the ESS, 
except for reductions in power, weight, and volume. 
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ESS Deltas to Shuttle PCM Software. This section is an overview of 
differences between space shuttle and ESS software. The significant items 
are delineated. Table 2-25 estimates the quantity of 32 -bit words which can 
be deleted from shuttle programs for ESS use. Table 2-26 identifies the 
additions and modifications required for ESS-peculiar demands. 

One of the deltas most readily identified is the lack of need on the ESS 
for mass memory. Reasons for eliminating mass memory are: 

Fewer system table requirements 

No display and control requirements 

Fewer diagnostic requirements 

Less complex mission requirements. 

Computer Size and Speed Requirements Summary. The following 
represent the preliminary computer size and speed requirements to perform 
the software functions for the ESS. 

Assumptions. The following assumptions have been used in arriving at 
size and speed estimates. 

The ratio of 75/25 (short/long) for instructions, i. e. , 75 instructions 
out of every 100 are half-word instructions. 

Data words are generally assumed to be half words (16 bit) except 
for guidance, navigation, and control where 3 2 -bit data words are 
assumed unless otherwise stated. 

Total storage is always expressed in whole (32 bit) words. 

Speed requirements are identified as KADS (equivalent adds per 
second divided by 1000). 

A 25 -per cent contingency factor is included for storage to allow for 
undefined requirements. 

The size and speed estimates shown represent worst-case analysis. 

Estimates. Tables 2-27 and 2-28 represent the overall sizing and 
speed estimates required for the ESS operation inflight. 
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Table 2-25. ESS Deletions From Shuttle Total Requirements 


item 

32 - Bit 
Words 

Exe cutive 


Program loader 

266 

Drum access method 

313 

Control sampling access method 

348 

Mass storage allocation 

228 

Executive services control 

19 

Integrated displays and controls 


Display format retrieval 

281 

Continuous and on-demand services 

156 

Input data interpretation 

94 

Device caution and warning 

31 

Display access method 

375 

Crew aid and assistance 

78 

Variable data update routines (digital and vector) 

2344 

Checkout and fault isolation 


Failure recording and display 

62 

Subsystem management 


Air-breathing engines 

92 

System tables 


Queue control table 

100 

Program control table 

320 

Mission phase core and drum maps 

3 75 

Display control and associated display tables 

1000 


ESS Versus Shuttle Computer Redundancy Criteria. The shuttle pro- 
gram has a redundancy requirement of FO/FS for all systems except for the 
DCM, which is designed for a redundancy level of FO/FO/FS (for crew sur- 
vival). The shuttle program meets this requirement for the DCM system by 
implementing a computer complex with four central processing units sharing 
12 modules of memory. This configuration provides the shuttle with 100- 
percent coverage for failure detection and fault isolation during the first two 
redundancy levels of FO/FO and a degraded coverage for the redundancy 
level of FS. This degraded FS capability, when considered with the capability 
provided by the man in the loop and the hardwire backup capabilities pro- 
vided in the shuttle design, satisfies the program requirement. 
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Table 2-26. ESS Development Deltas From Shuttle Summary 



Number of 
Instr. 
Affe cted 

Executive 

Timer routines — modified -1 


75 

Data sampling control functions — new development 

270 

Sequencing — new development^ 

425 

COFI 


Reasonableness tests — modified 

339 

Functional path isolation — modified 

880 

System reconfiguration — modified 

150 

Diagnostics — modified 

4400 

System tables 


Mission profile — new development 

3 000° 

System status — modified 

210 

Task and executive control — modified 

150 

Sequencing action tables — new development 

300 

System reconfiguration table — modified 

44 

Test point limits — modified 

1140 

Flight control 


Ascent TVC — new development 

406 

OMS TVC — new development 

406 

A CPS — new development 

233 

Notes: ■'■Modified assumes that change of up to 5 0 percent can be 

applied. 

^New development assumes 100 percent change can occur. 

^Table estimates assumed to be 32-bit words. 


In considering the ESS requirement of FO/FS, it is necessary to 
evaluate the criticality placed on the fail safe condition. If the shuttle 
rationale is used, it becomes necessary to establish the significance of the 
man in the loop. Since the ESS is non-manned, it cannot rely upon a pilot to 
assist in accomplishing the vehicle mission. This, in addition to the fact that 
there are no hardwire backup systems, makes it necessary for the ESS DCM 
subsystem to be fully operational through two failures, and hence to maintain 
100-percent coverage for both levels of redundancy to satisfy the FO/FS 
requirement. This is accomplished by using the shuttle DCM computer 
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Table 2-27. DMC Memory Requirements (32-Bit Words) 


Attitude 

Reference 

Guidance 


Control 

Exe cutive 

COFI 

Subsystems 

System 

Tables 

25-per cent 
Margin 

Total 

952 

6371 

2879 

1707 

1505 

7932 

2008 

7600 

7739 

38,693 


tv 

t 

w 




t\J 


Table 2-28. DMC Speed Requirements (KADS) 


Mission Phase 

Attitude 
Refer ence* 

Guidance * 

Navigation* 

Control 2 

Exe cutive 

COFI 2 

Subsystems 2 

Totals 

Boost 

19. 60 

0. 28 

15. 98 


14. 845 

16. 894 

4.0 

71. 599 

Separation 

19. 60 

0. 28 

15. 98 

15. 57 

14.845 

16. 894 

4. 0 

87. 169 

ESS ascent orbit insertion 

21. 28 

48. 12 

15. 50 

15. 57 

14. 845 

16. 894 

4. 0 

136. 259 

On-orbit 

35.49 

2. 87 

47. 07 

2. 69 

14.845 

16. 894 

4. 0 

123.859 

Rendezvous 

20. 27 

0. 96 

15. 50 

2. 69 

14.845 

16. 894 

4. 0 

75. 159 

1 Deorbit target 

21. 28 

4.00 

0.299 

15. 57 

14. 845 

16. 894 

4. 0 

76. 888 

Notes: ^Determined from Honeywell Document 21602-SDD (29 March 1971) 

^Determined from NASA Document MSFC-DRL.-008A (25 June 1971) 
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complex of four central processors sharing twelve memory modules. When 
the recovery of ESS avionics is factored into the decision to use four com- 
puters to accomplish FO/FS criteria with 100-percent coverage for failure 
detection and isolation, it becomes the most cost effective approach for 
attaining the confidence level required for the ESS mission. 

ESS Deltas to Shuttle On-Board Checkout. The ESS program uses 
shuttle software to the maximum, but because of the difference in program 
objectives, there are primary differences in the hardware required. The 
decisive factor in the area of onboard checkout of the ESS is the lack of the 
man-machine interface which exists on the shuttle DCM subsystem. On the 
shuttle, this man-machine interface is primarily provided by the display and 
control hardware and software. For the ESS program, checkout will be per- 
formed primarily with the computational capability provided in the ESS DCM 
subsystem. External equipment will be provided to perform the functions 
provided by the display and control section of the shuttle DCM system. This 
technique provides maximum utilization of shuttle software and minimizes 
the delta required to provide the ESS with the capability of performing sub- 
system checkout. 

Redundancy Management. Redundancy is provided primarily to achieve 
a higher probability of mission success than can be expected from .a simplex 
system and to conform to specifications which dictate system tolerance to 
two or more failures. To accomplish the goals of a high probability of mis- 
sion success and a FO/FS system, various modes of redundancy are imple- 
mented by the individual ESS subsystems. The DCM subsystem.provides, 
through redundancy management, the necessary capability to maintain the 
onboard subsystems at the proper operational level. 

In this section the typical levels and modes of redundancy implemented 
by the ESS and the methods recommended for managing this redundancy are 
briefly described. The approach taken is described, along with the require- 
ments, ground rules, and examples- of the use of functional elements in the 
various subsystems. 

The purpose of redundancy management is to provide a means for per- 
forming the processes and actions necessary to neutralize a detected failure 
in a functional path, record the failure, and reconfigure the functional path 
to maintain operational capability. 

Redundancy management is not a prime factor in establishing the level 
of redundancy. It may, however, be the deciding factor in implementing 
redundancy. 
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The approach used to establish the redundancy management of the ESS 
operational system is based on a thorough analysis of the complete system. 
This analysis establishes the criticality of the individual subsystems. It 
provides an inventory of available functional paths, redundant components 
contained in the functional paths, and alternate methods which may be used 
to accomplish a desired function. The data thus obtained is then processed 
to provide an initial system configuration, and the sequence for use of redun- 
dant components. The techniques are also established for maintaining oper- 
ational status of the individual components. 

Two basic types of redundancy are implemented on the ESS program. 
These techniques are masking and sparing. Masking is characterized by 
performing a given function by means of three or more units and assuming 
the correct function will be represented by the majority of units in the event 
of a malfunction. Sparing is characterized by performance of a function by 
a prime unit and including in the system a means of determining when the 
prime unit is operating correctly and a means of replacing the prime unit 
with a good unit in the event of a failure. These two redundancy techniques 
in conjunction with the coverage function (that is, the probability of correctly 
detecting the need to replace a functional component if the component is not 
successfully and efficiently recovering from the malfunction) provide the 
basis'for redundancy implementation and management for the ESS subsystems. 

The level of redundancy implemented for the ESS avionics system is 
FO/FS for all systems affecting booster safety and ESS deorbit capability. 

All other functions, as a minimum, meet the reliability criteria established 
for the Apollo/Saturn program. Refer to Figure 2-127 ESS failure criteria. 

The following are examples of typical circuits implemented in the ESS 
subsystem with methods which will be used to manage these circuits during 
operation: 

DCM redundancy management (Figure 2-128) 

Data bus redundancy management (Figure 2-129) 

Typical subsystem redundancy management (Figure 2-13 0) 

Thrust vector control redundancy (Figure 2-131) 

The figures referenced above are intended to represent the concepts to be 
utilized on the ESS program and are not to be taken as -the complete analysis 
required for the individual subsystems. 
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Analysis for Redundancy Implementation and Management. An efficient 
redundancy management scheme involves the ability to accurately assess 
performance on functional paths in a dynamic operating environment. To 
establish the redundancy management requirements for an operational sys- 
tem, it is necessary to investigate all facets of the program. The investiga- 
tion must include an analysis of the redundancy provided in the individual 
subsystem capability along with the additional redundancy provided in the 
control circuits of the subsystem. 

Using a motor-driven switch as an example, the following is a typical 
presentation of the analysis used to develop the implementation and manage- 
ment of a specified redundancy level. 

The first step in the analysis is to evaluate the criticality of the 
system, and the criticality of the component to the proper opera- 
tion of the system. For this example it is assumed the initial 
evaluation reveals that the proper operation of the switch is cri- 
tical to the mission success. This fact establishes the criteria 
for the required level of redundancy. For the ESS vehicle, the 
redundancy requirement is FO/FS so this is the level to be 
developed in the analysis. 

Figure 2-132 is a typical schematic for a motor-driven switch with 
position indicators. The switch is the make-before-break type. 

To implement redundancy effectively, it is necessary to perform a 
failure mode effects analysis (FMEA) of the function or component in ques- 
tion. The FMEA for the motor switch provides the information discussed 
here. 


The switch may fail in any of five modes: (1) position indicator fails to 

open, (2) position indicator fails shorted, (3) switch fails to transfer, 

(4) switch fails with output contact open and (5) switch fails with output con- 
tacts shorted. A failure of the position indicators in either the open or 
shorted mode will not affect the operation of the switch but will eliminate 
the capability to provide verification of proper operation. This failure could 
be a fail-safe condition. This fail-safe rating is upgraded to a fail opera- 
tional if other sensors are provided in the circuit which, in addition to their 
normal function, can also be used to deduce the switch position. This is 
accomplished by adding a current sensor in each of the contact legs of the 
switch or, in instances where only one contact is used, it will suffice to 
monitor the load to establish proper operation of the switch. 


A comparison of the lines monitoring the source and load as depicted 
in Figure 2-133 will indicate switch position. The source must be monitored 
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to provide valid information in the situation where the load is removed from 
the power source. The switch position can also be deduced by comparing 
the current at the source of the current sensor with that at the output. 

An output of the current sensor will indicate a switch closed position. 
No output indicates an open position, provided this is verified by the source 
mo nitor . 

In Figure 2-134, monitoring the load alone will not indicate switch 
operation. This monitoring point will provide backup data for other measure 
ments. The output of the two current sources plus monitoring the source 
will provide adequate information to deduce switch position. The output of 
the individual current source can be used to indicate actual switch position 
provided the line monitoring the source indicates it is active. 

Instances where the switch fails to transfer or fails shorted or open 
can only be considered non-safe when proper operation is critical to mission 
success. An operational failure requires that the failed unit be isolated from 
the circuit and the function be transferred to a redundant component. 

Figure 2-135 is a method of providing isolation so that the switch can 
be removed from the circuit when it fails to transfer or hangs up with the 
two contacts shorted. 

Figure 2-13 6 represents the circuitry required to implement redundanc 
and to provide the necessary information to manage this redundancy. The 
configuration represented in Figure 2-13 6 provides a redundancy level of FO. 
To implement FO/FS, a third component is required. 

2.3.3 Communications Subsystem 

The Communications Subsystem (COMM) is provided to fulfill the 
requirements for transmitting and receiving all information necessary to 
accomplish the ESS mission. The COMM will provide telemetry data, turn- 
around ranging data, and will receive up-data and range safety commands. 

An integrated approach to the COMM provides three subsystems: data, RF, 
and range safety. 

Communications Requirements 

As the COMM subsystem block diagram (Figure 2-137) shows, the 
three subsystems serve as carriers for five data links: the data bus, track- 
ing and ranging, and range safety. The operational timelines of the COMM 
subsystem are shown in Figure 2-138. 
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Figure 2-135, Motor-Driven Switch Isolation Technique 
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Data Subsystem. The data subsystem provides the ability to format 
up-data for acquisition by the data bus, condition data bus signals suitable 
for modulation of the S-band transmitters, transmit engine and CBW/FM 
data and select redundant transponder and the required modulation mode for 
the mission phase. 

The up-data system is operational throughout the ESS mission, being 
required for communications with all ESS systems through the data bus. The 
data relay satellite system (DRSS) provides the relay link with Manned Space - 
flight Network (MSFN) during periods whenever direct contact with the ESS 
is not possible. 

The modulation and switching unit places the data bus information, 
CBW/FM information, and engine data on subcarriers for modulating the 
S-band transmitters. The switching function to support the redundancy 
requirement of the data transmission system is also performed by the modu- 
lation and switching unit. 

The CBW/FM telemetry provides the capability to transmit high fre- 
quency data, frequency multiplexed, and summed with the engine data sub- 
carrier for transmission by the S-band FM transmitter. A system of 22 data 
channels is proposed, and with the vibration multiplexer a greatly increased 
number of measurements may be transmitted. This telemetry system is 
active throughout the boost phase of the ESS mission. See Figure 2-138. 

RF Subsystem. The RF subsystem provides the ability to receive 
up-data from MSFN or the Tracking and Data Relay Satellite (TDRS), receive 
and provide coherent Pseudo-random Noise (PRN) and doppler tracking and 
ranging data, and transmit telemetry signals to MSFN, either direct or by 
the TDRS. The RF system normal mission sequence is dictated by the data 
system. Selection of antenna is controlled by the central processor. 

The S-band transponders are operational throughout the orbital inser- 
tion phase; however, only a stand-by function is served by one of the units. 
After orbital insertion, one unit will operate throughout the ESS mission to 
provide telemetry data and to receive up-data and tracking data via the TDRS. 

The S-band FM transmitter is utilized to transmit engine data and 
CBW/FM telemetry data to MSFN. This unit operates during the orbital 
insertion phase of the mission and does not operate during periods when high 
data-rate transmission is not required. The data bus information may be 
transmitted via the S-band FM link as an alternate transmission mode. 

The S-band power amplifiers are utilized to increase the RF power 
from the transponder and transmitter to a power level sufficient for data to 
be received at MSFN. During the orbital insertion phase, the primary power 
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amplifier is providing 20 watts to the antenna system. The secondary power 
is for backup. During the remainder of the mission, only one power ampli- 
fier is utilized; half of the system is on stand by or providing high data rate 
FM link amplification, and the other half of the primary link operates at the 
low power level (5 watts) to provide low data-rate telemetry transmitter 
amplification to MSFN or TDRS. 

The antenna switch unit (ASU) provides the ability to select the appro- 
priate antenna for transmission of data through control of the central proc- 
essor. The selection depends upon the ESS attitude, and the selection of the 
S-band receiver to receive up-data and ranging signals. 

Range Safety Command Subsystem. The ESS range safety subsystem 
provides a sure means of terminating the vehicle flight subsequent to ESS/ 
booster separation by up-link command to the ordnance system in the event 
of deviation from the preplanned trajectory. Figure 2-139 is a block diagram 
of the range safety command subsystem. 

The range safety subsystem will be functional from booster /ESS separa- 
tion, plus 15 seconds, through main propulsion system engine cutoff. After 
achievement of orbit, the range safety subsystem will be secured. The 
range safety command system uses a language in which each character of the 
address and function word is chosen from an alphabet of 2.1 characters. The 
21-character alphabet is formed from a subalphabet of seven symbols taken 
simultaneously two -at-a-time. Each symbol is an audio frequency tone in 
the modulation bandwidth of the transmitter. A sequence of 11 dual -tone 
bursts comprises an "on" command message. Each address character is 
chosen by use of identical code plugs, one in the ground encoder and the 
other in the vehicle decoders. When a valid complete message has been 
received, the decoder relay channel corresponding to the transmitted com- 
mand will be energized and a termination signal has been achieved. 

In consonance with ESS goals, use of highly reliable, flight -proven 
equipment with the necessary redundancy was to be an objective. It was 
therefore determined that the Saturn S-II equipment be selected as the tech- 
nical base for ESS. The S-II range safety system has been thoroughly flight 
proven, will not require any major vehicle changes, and is available. It 
also meets the requirements for range safety systems for vehicles launched 
at KSC as defined in the Air Force Eastern Test Range Manual, AFETRM 
127-1. 


Propellant Dispersion. The propellant dispersion system proposed for 
the ESS vehicle will be the same as that presently used on the S-II; it is a 
fully qualified system and meets the requirements of AFETRM 127-1. Fig- 
ure 2-140 is a block diagram of the proposed ESS propellant dispersion 
system. 
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The propellant dispersion system is to be inhibited from being armed 
until booster-ESS separation plus 15 seconds. Then propellant dispersion 
is accomplished as follows. After the secure range safety command system 
(SRSCS) receives a command for propellant dispersion arm and engine cut- 
off, a pulse signal is sent to the range safety system controller (RSSC) which 
closes a set of relay contacts, arming an exploding bridgewire (EB¥) firing 
unit within 1. 5 seconds. Upon receipt of the first command, an additional 
signal is sent from the RSSC to the stage engine cutoff system for shutdown 
of the main engines. 

The second step, the range safety propellant dispersion command, 
triggers the EBW firing unit. This releases its stored-up energy to the 
EBW detonator, and detonates an explosive column in the safety and arming 
(S/A) device. The shockwave propagates through the S/A device and passes 
to the CDF assemblies, thereby transferring the explosion to the tank 
destruct assemblies. The tank destruct assemblies are linear -shaped explo- 
sive charges that rupture the propellant tanks and disperse the propellants. 
Either of the two independent systems is capable of imposing aero thrust and 
initiating propellant dispersion on the ESS. 

Another range safety radio command is used to "safe" the system by 
removing the 28-vdc supply to the receivers and decoders. This will be 
accomplished once orbit insertion has been assured. 

Communications Subsystem Description 


Data Component Description. 


Up-Data Decoder. The up-data decoder contains the 70 kHz discrimi- 
nator and the up-data converter. Figure 2-141 is a block diagram of the 
up-data register. The 70 kHz discriminator and the up-data converter are 
Apollo equipment. 

The up-data are received through the antenna selected by the antenna 
switch and routed to the receiver where the 70-kHz subcarrier containing the 
up-data is separated from the composite signal and routed to the up-data 
converter. Either receiver may be utilized to receive up-data; the modula- 
tion and mixing ACT selects the receiver from redundancy and configuration 
data. The 70-kHz discriminator detects the 2-kHz up-data for demodulation 
by the sub -bit detector. The 1-kbps data are derived from the composite by 
the sub-bit detector; however, five sub-bits comprise a single command bit. 
The function of assembling the 150 sub-bit message into a 30-bit command 
message is performed by the up-data decoder. One bit of the five sub-bit 
sequence contains the necessary information, the remaining four being used 
for determining sub-bit error or message validity. The command message 
is transmitted serially to the up-data ACT select buffer. The 200-cps clock 
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is utilized to clock the serial data into the ACT select buffer. An interrupt, 
generated by the 70 kHz discriminator when in phase lock, is sampled by the 
data bus to inform the DMC when up-data are being read into the ACT select 
buffer. A message validity interrupt is used to determine if noise quantity 
is such that reliable updata cannot be received. 

Modulation and Switching Unit. The modulation and switching unit 
comprises the modulation selector module, the subcarrier modulator assem- 
blies, the modulation emphasis and mixing module, and the amplifier and 
transponder selector module. Figure 2-142 is a block diagram of the modu- 
lation and switching unit. 

The modulation selector module contains the l:.miting and shaping 
amplifiers and gates for the 10-kbps engine data and the data bus information. 
Here the input format to the modulator assemblies is selected and the 
selected data are shaped and limited to the proper amplitude. There are 
three modes selectable: (1) 10-kbps engine data, (2) data bus information, 

and (3) CBW/FM information to the input of the modulators. 

The telemetry alternate mode switches the data bus information to the 
input of the 1. 25 mHz modulator. There are three biphase modulators to 
provide the subcarriers for the engine data and data bus information. The 
1. 0 mHz modulator conditions the data bus information during all mission 
phases. The 1.25 mHz modulators are utilized during the boost phase only 
and conditions engine 10-kbps data. The 1.25-mHz modulator provides 
redundant capability for transmission of data bus information in the telem- 
etry alternate mode. During this mode, engine data for only one MPS engine 
are transmitted. 

The modulation emphasis and mixing module contains the switchable 
emphasis networks to provide optimum deviation of the transmitters under 
the various modulation modes. A redundant amplifier is used to ensure 
ability to modulate the transmitter to support the deorbit phase of the mis- 
sion, The amplifier and transponder selector module provides the capability 
to switch the modulation input to either transponder. 

CBW/FM Telemeter. The CBW/FM telemeter consists of a conven- 
tional system of subcarrier oscillators and mixer amplifiers to frequency- 
multiplex subcarriers containing high frequency data. The pre-emphasis 
schedule is set up by amplitude adjustment of the subcarrier oscillator. The 
subcarriers have a data frequency response of 1000 Hz; however, lower 
frequency response with an increased amplitude accuracy is available. 
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To provide for an increased number of vibration type data channels, a 
time division multiplexer is proposed. This vibration multiplexer contains 
a program section to provide synchronization and timing data for identifying 
the multiplex signal segments. 

RF Component Description. 

Unified S- Band Equipment (USBE). The USBE consists of two trans- 
ponders, an FM transmitter, and a power supply in a single package. The 
USBE is used for tracking and ranging, transmission of data bus information 
extracted by the ACT select buffer, and reception of up-data. Figure 2-143 
is a block diagram of the USBE. 

The USBE tracking method employed is the two-way or double -doppler 
method. In this technique, a stable carrier of known frequency is trans- 
mitted to the ESS where it is received by the phase-locked receiver, multi- 
plied by a known ratio, and then re -transmitted to the MSFN for comparison. 
Because of this capability, the USBE is also referred to as the S-band 
transponder. 

For determining ESS range, the MSFN phase-modulates the transmitted 
carrier with a PRN binary ranging code. This code is detected by the ESS 
USBE receiver and used to phase -modulate the carrier transmitted to the 
MSFN. The MSFN receives the carrier and measures the time delay between 
transmission of the code and reception of the same code, thereby obtaining 
an accurate measurement of range. Once established, this range can be 
continually updated by the double-doppler measurements discussed earlier. 
The MSFN can also transmit up-data commands to the ESS USBE by means 
of the 70 kHz subcarrier. 

The USBE transponder is a double -superheterodyne phase-lock loop 
receiver that accepts a 2106.4-mHz, phase -modulated RF signal containing 
the up-data subcarrier and a PRN code when ranging is desired. This signal 
is supplied to the receiver via the triplexer in the antenna switching and 
multiplex unit. 

When operating in a ranging mode, the PRN ranging signal is detected, 
filtered, and routed to the USBE transmitter as a signal input to the phase 
modulator. 'The input frequency is coherently detected and used as the ref- 
erence frequency for receiver circuits as well as for the transmitter. 

The coherent amplitude detector (CAD) provides the automatic gain 
control (AGC) for receiver sensitivity control. 
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The USBE transponders are capable of transmitting a 2287. 5 -me 
phase-modulated signal. The initial transmitter frequency is obtained from 
one of two sources: the voltage-controlled oscillator (VCO) in the phase- 
locked USBE receiver or the auxiliary oscillator in the transmitter. Selec- 
tion of the excitation is controlled by the CAD. If ranging has been selected, 
the up- link information is routed from the receiver wide-band detector to the 
phase modulator in the transponder transmitter. Additionally, data from the 
modulation and switching unit are used to phase -modulate the carrier. The 
output power is approximately 250 mw. 

The USBE also contains a separate FM transmitter, operating at 
2272. 5 mHz, permitting transmission of engine data and providing backup 
for transmission of the data from the ACT select buffer. Output power of 
the FM transmitter is 100 mw. 

S-Band Power Amplifier. The S-band power amplifier (PA) equipment 
amplifies the RF output from the USBE transmitters when additional signal 
strength is required for adequate reception of the S-band signal by MSFN. 

The amplifier equipment consists of a triplexer, two traveling -wave tubes 
for amplification, power supplies, and the necessary switching relays and 
control circuitry. The S-band PA is contained in a single electronics pack- 
age. Each PA requires about 15 watts for warmup, 45 watts at low power 
and 90 watts at high power of 3-phase 400-cycle ac power and about 2. 5 watts 
28-vdc power. Figure 2-144 is a block diagram of the S-band power 
amplifier. 

All received and transmitted S-band signals pass through the S-band 
PA triplexer. The 2106. 4-mc S-band carrier received by the ESS enters the 
S-band PA triplexer from the S-band antenna equipment. The triplexer 
passes the signal straight through to the USBE receiver. The 2287. 5-mc 
output signal from the USBE transponder enters the S-band PA where it is 
either bypassed directly to the triplexer and out to the S-band antenna equip- 
ment, or amplified first and then fed to the triplexer. There are two PA 
modes of operation: low power and high power. The high-power mode is 

automatically chosen for the PA connected to the FM transmitter. 

Antenna Switching Unit. The antenna switch unit provides the ability 
to select the proper antenna for optimum transmission and receiving of sig- 
nals destined for or arriving from MSFN. The selection of the antenna is 
controlled by the central processor from data determining the look angles. 

The antenna switching unit consists of a single -pole 4-throw coaxial 
switch for antenna selection to the triplexer in the S-band power amplifier 
and a single-pole 2-throw coaxial switch for selection of the S-band receiver 
to be utilized for ranging and up -data received. 
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Figure 2-144, S-Band Power Amp Block Diagram 
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Range Safety Command Receiver. A block diagram of the range safety 
command receiver is shown in Figure 2-145. 

The UHF FM signals induced in the antenna system are coupled to a 
dual -cavity, tunable range of 406 to 45 0 mHz. The tuned dual- cavity p re- 
selector functions as an RF bandpass filter whose output is amplified and 
applied to the first mixer. The RF signal is heterodyned in the first mixer 
with a signal three times the frequency of the local oscillator. The signal 
output of this mixer is amplified and heterodyned in the second mixer with 
the local oscillator signal. The second mixer output is coupled to the inter- 
mediate frequency (IF) bandpass filter. This filter determines the overall 
receiver bandpass characteristics. The filter output is coupled to & three 
stage IF amplifier, which in turn feeds a limiter and a standard Foster- 
Seely discriminator. The detected audio signal from the discriminator is 
coupled to an audio preamplifier, then to a driver that feeds the push-pull 
audio output stage; the output stage has two isolated outputs each of which 
may be used to feed the range safety decoder. 

Decoder Operation. Figure 2-146 is a block diagram of the range 
safety command decoder. 

The composite audio from the receiver is fed to the decoder isolation 
transformer. The transformer feeds a push-pull filter driver stage that 
drives seven filters. Once the filter output reaches the proper level, the 
threshold decoder will produce an amplitude -standardized pulse which is 
then fed to a 7 by 21 AND matrix. The actual threshold leveTis raised to an 
optimum level by use of an unbias circuit, the optimum decision circuit. 

This circuit operates by sampling the peak voltage in the filter primary and 
instantaneously developing a dc bias proportional to this voltage. This bias 
is then fed forward and used to set the threshold decision level of the detector 
to some constant ratio below the peak voltage output of the filter. This 
technique allows the decoder to operate reliably in a much wider signal input 
dynamic range than would be otherwise possible. 

The 21 outputs of the AND matrix are routed to the code plug which 
unscrambles the code in the same fashion in which it was scrambled by the 
ground encoder plug. The code plug output is applied to the address error 
detector, which acknowledges the correct address word by supplying, for a 
specific time, one input to each AND output relay driver. The second input 
to each AND output relay driver is the command word from the 7x21 AND 
matrix. 

When a valid complete message has been received, the decoder relay 
channel corresponding to the transmitted command will be energized, and 
28 volts will appear at the proper output pin for approximately 25 milliseconds 
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Figure 2-146. Range Safety Command Decoder 
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This 28 -volt signal is fed to the range safety controller for execution of the 
propellant dispersion commands. 

Very High Frequency (VHF) Antenna. The range safety command 
antenna subsystem operates at 450 mHz with sufficient coverage to permit 
remote control of flight termination under any flight conditions. 

The use of a hybrid junction in the antenna subsystem provides optimum 
means of coupling four antennas with two receiver.s. A high degree of isola- 
tion between receivers is maintained at all times while the bandpa>ss filters 
provide additional system selectivity. Ground checkout is achieved through 
the directional coupler. 

To achieve a near-omnidirectional system, the antennas are placed at 
approximately 90-degree intervals around the ESS periphery. The polariza- 
tion will be linear to ensure a maximum polarization loss of 3 .db when used 
in conjunction with the circularly polarized ground system. 

Propellant Dispersion. 


Range Safety- System Controller. The controller contains the relay 
logic for control of the following; power to the- receiver -decoder subsystem; 
arming and' triggering of the firing unit; measurement signals; and' engine 
cutoff command. 

Exploding Bridgewire Firing Unit. The EBW f-iring unit, a capacitance 
discharge system, initiates the PD subsystem ordnance components to dis- 
perse the propellants. The unit consists of a charging circuit, a regulator, 
a trigger circuit, and a switching device. 

Upon the EBW arm command, 28 vdc is applied to the charging circuit 
of the EBW firing unit. The charging circuit converts the 28 -vdc input to a 
23 00-volt charge stored in a one-microfarad capacitor. The trigger circuit 
releases the stored charge of the capacitor into an EBW detonator. This 
initiates the PD explosive trains. 

Exploding Bridgewire Detonator. The EBW detonator is an electrically 
initiated ordnance device used to trigger other ordnance devices and explosive 
ordnance trains. When the high-energy pulse (high voltage) of the EBW fir- 
ing unit is applied to the bridgewire of the detonator, the wire explodes and 
vaporizes, rapidly releasing a large amount of energy. The released energy 
initiates the explosive charge of the detonator (which is in contact with the 
bridgewire). The output pulse (shock wave) of the explosive charge is suffi- 
cient to initiate the explosive columns of the safety and arming device. 
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An air gap is built into one input lead of the detonator. It allows, the 
high-energy pulse of the firing unit to pass to the bridgewire but blocks acci- 
dental voltage applications of up to 500 volts dc or 250 volts ac. 

Safety and Arming Device. The safety and arming device, on electrical 
command through the umbilical, aligns two explosive columns in the rotor 
shaft with two EBW detonators and two confined detonating fuse (CDF) assem- 
blies installed in the device. The device can also be safed manually in the 
event of power failure. Markings on the end of the housing provide a visual 
means of determining shaft position; electrical position-indicating switches 
provide indication through the umbilical. 

Confined Detonating Fuse. The CDF consists of a low-energy mild- 
detonating fuse (MDF) within a multilayer protective sheath designed to con- 
fine all of its explosive effects. A CDF assembly consists of an appropriate 
length of CDF and two end fittings. Each end fitting is provided with a 
threaded connector for attachment of the CDF assembly to various ordnance 
components. 

Ordnance Tee. The ordnance tee is an explosive device employed to 
transfer the detonation from one CDF assembly to two other CDF assemblies. 
To assure initiation of the two other CDF assemblies, the tee contains a 
small explosive charge. 

Diquid Hydrogen Tank Destruct Assembly. The DH 2 tank destruct 
assembly consists of two sections of linear-shaped charge (DSC), a charge 
coupler, 22 sliding -type mounting clamps, and two CDF receptacles. Each 
section of the DSC is 15 feet in length and approximates a 120-degree V in 
cross section. Upon detonation, the destruct charge cuts a 30-foot vertical 
opening in the LH 2 tank. 

The destruct charge installed in the S-II system tunnel is attached to 
the tunnel inter costals by sliding mounting clamps. The charge coupler is a 
fixed mounting clamp, also attached to an intercostal of the system tunnel.. 
Friction clamps bolted to the intercostals allow the destruct charge to slide 
in the clamp upon thermal expansion or contraction of the stage structure. 

DO 2 Tank Destruct Assembly. The LO 2 tank destruct assembly is a 
Teflon-covered linear -explosive charge. Each end of the charge is covered 
with a metal ferrule; one ferrule contains a booster charge, the other a 
metal eye used for loading the charge into the destruct charge mounting tube. 
The charge assembly consists of two linear explosive charges, two DC >2 
charges and CDF assembly adapters, and an explosive charge -loading line. 
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The L02 / tank destruct charge installation mounts two linear destruct 
charges in a figure-eight-shaped tube. Upon detonation of the charges, the 
tube {because of its configuration) performs the function of a double -V linear - 
shaped charge. The tube is mounted and attached to the inner side of the 
S-II aft skirt/interstage structure at Station 266.5, and makes a 13-foot 
opening in the tank and structure. 

Trade Studies and Performance Analysis 

Redundancy Trade Study. The communications subsystem is critical 
to the ESS mission in the rendezvous and deorbit phases in that telemetry is 
necessary to communicate ESS systems status and platform position, and 
tracking data. Updata is necessary to provide the ability to command deorbit 
functions and timing parameters. The components utilized to provide these 
functions are Apollo system equipment, and redundancy is provided on por- 
tions of those systems that are less reliable than required for Apollo space- 
craft operations. 

Item 1 of the paragraph entitled "Vehicle Characteristics" in Section III 
of the NASA Study Control Document (Pages 2 and 2A) exempts systems using 
hardware of Saturn and Apollo reliability standards from the FO/FS criteria 
applied to new subsystems. However, under the same item, a statement 
requires review of these systems and study of alternate approaches to estab- 
lish FO/FS criteria. Figure 2-147 depicts the existing Apollo S-band com- 
munications system. From this block diagram, it is determined that the 
following components, if inoperative, would result in the ESS deorbit capa- 
bility being lost: 

Antenna 

Antenna switch 

Receiver switch 

By-pass switch 

Power amplifier switch 

Triplexer 

Power combiner 

These items are inherently of high reliability due to. their simple nature and 
minimum operational components. 
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Figure 2-147. Existing Apollo S-Band Communication System 
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Figure 2-148 depicts a system of entirely redundant capability and 
many switching modes to allow several failures to occur and retain deorbit 
capability. While this appears to have solved the case of non-redundant 
paths in the Apollo hardware, there are a number of disadvantages brought 
about that may overbalance the advantage gained by redesign. These dis- 
advantages are: 

15 controls as opposed to 4 controls 

Complex fault isolation program required 

Large number of response verification measurements 

Modification of forward skirt structure to accommodate additional 
antennas 

An increased number of components, thereby lowering overall 
reliability 

The advantages of the redundant system are: 

Minimum of two failures for communications system 

Capability to maintain both receivers operating for more rapid response 
to failed receiver switching 

Ability to select antenna for optimum transmission independent of 
onboard look angle program 

The advantages of the redundant system and corresponding redesign of 
existing components and qualification of new components were weighed and at 
this time it appears these advantages do not warrant the redesign required. 

If the redundant system were required, the components utilized are existing 
hardware and the cost increase would be in the structural modifications of 
the forward skirt and analytical tests to support antenna pattern analysis. 

RF Power Budget Analysis. The following parameters are used in 
calculating the RF system power budget and are derived from the basic mis- 
sion profile and the data requirements to support mission communications: 

270 nautical-mile 

24,000 nautical-mile range to DRSS 

DRSS receiver noise figure (N ) = 4 db 

^ IT 
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Transmitter power = 20 watts or 13 dbw 

DRSS antenna gain (G ) = 3 2.3 db 

DRSS transmitter power = 20 W or 13 dbw 

Transmitter and receiver losses (L) = 4 db 

Antenna noise temperature (T) = 300°K 

ESS antenna gain (G,^,) = 0 db 

S/N Ratio required (S/N) = 12 db 

MSFN antenna gain {3 0') = 43 db 

MSFN transmitter power = 10 KW = 40 dbw 


The power budget parametric equations and constants are shown in 
Table 2-29. The ability to receive and demodulate data depends upon the 
antenna noise temperature, the bandwidth of the data, and the receiver noise 
figure (Np.). The antenna temperature (300 F) and the receiver noise figure 
are assumed constant for this study, the variable (bandwidth) being the con- 
trolling factor for data quality. The subcarriers and corresponding band- 
widths are shown in Table 2-30 and are used to derive the receiver noise 
power for the various data subcarriers listed in that table. A definition of 
the ESS communications modes and calculations of the carrier power during 
those modes are shown in Table 2-31. The parameters used in determina- 
tion of the carrier power are the transmitted power, antenna gain, path loss 
and system losses. 


Table 2-32 contains the signal-to -noise and margin tabulation for each 
subcarrier of each communication mode. Adequate margin exists for all 
subcarriers during the boost phase for all RF links. For communications 
via the Data Relay Satellite System, the signal margins are below that 
desired; however, additional considerations for modulation techniques , prob- 
able higher power from the data relay satellite, redistribution of power into 
the subcarriers, and signal-to -noise improvement from receiver character- 
istics can improve these margins to acceptable values. 
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Table 2-29. Power Budget Parametric Equations and Constants 
Receiver noise power (P ) = KTB 
Receiver sensitivity (S^) = P + N 

Space loss (Ap) = 37. 8 + 20 Log f (in MHz) + 20 Log D {in nmi) 

P T = S R + A P + L ’ °T ' + S/N 

Modulation loss = 10 log P^ / power in subcarrier 

Subcarrier power received = P + mod loss - A + L - G - G 

4 P 1 R 

K t = -204.8 dbw + 10 Log B 
Ap for 1000 nm = -164, 6 db 
A for 24, 000 nm = -191.2 db 

Jr 

-23 

K ~ 1.38 x 10 watt-sec 
T - 300 K 

Table 2-3 0. Receiver Noise Power for Subcarriers (KTB) 


Data 

Bandwidth (KHz) 

P N (KTB) 

Up-data 

6 

-167. 0 

PEN ranging (up) 

1.8 

-172.2 

Carrier (PM) 

1 . 0 

-174.8 

PRN ranging (down) 

0. 5 

-177. 8 

FM/FM telemetry 

400 

-148. 8 

High- rate data bus 

50 

-157. 8 

Low-rate data bus 

2 

-171. 8 

Engine data 

10 

-164. 8 
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Table 2-31. Communication Modes and Mission Phase 


A. Boost phase PM up-data. 

B. Boost phase PM down-data. 

C. Boost phase FM down-data. 

D. Orbital operation up-data via DRSS. 

E. Orbital operation PM down-data via DRSS. 

Mode A Carrier Power Mode 

B and C Carrier Power 

P^. = 40 dbw 

P^, = 13 dbw 

G_ = 43 db 
T 

G t = 43 db 

A = - 164. 6 db 

Jr 

A p = - 164. 6 db 

L = 4 db 

L> = 4 db 

-85. 6 dbw 

-112. 6 dbw 

Mode D and E Carrier Power 
P T = 13 dbw 
G t = 32.3 db 
A p = -191. 2 db 


L = 4 db 


-150 dbw 
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Table 2-32. Signal to Noise and Signal Margins 


Mode 

Channel 

Mod 

Loss 

(db) 

Subcarrier 

Power 

(dbw) 

Receiver 

Sensitivity 

(dbw) 

Signal 

Noise 

(db) 

Required 

Signal/Noise 

(db) 

Margin 

(db) 

A 

Up- data 

7. 7 

-93.3 

-163. 0 

69.7 

15. 5 

54.2 


PRIM ranging 

8. 6 

-94.2 

- 168. 2 

74. 0 

3. 0 

71. 0 


Carrier 

8. 3 

-93. 9 

-170. 8 

76. 9 

6. 0 

70. 9 

B 

High-rate data 

8. 0 

-120. 6 

-153.8 

33.2 

12. 0 

21.2 


Engine data 

12. 5 

-125. 1 

-160.8 

35. 7 

12. 0 

23. 7 


PRN ranging 

12. 9 

-125. 5 

-173.8 

48. 3 

3. 0 

45. 3 


Carrier 

8. 9 

-121. 5 

-170.8 

49.3 

6. 0 

43. 3 

C 

FM/FM data 

0.8 

-113. 4 

-144. 8 

31.4 

12. 0 

19.4 


Engine data 

12. 5 

-125. 1 

-160. 8 

35. 7 

12. 0 

23. 7 

D 

Up -data 

7. 7 

-157. 7 

-163. 0 

5.3 

15.5 

-10. 2 


PEN ranging 

8. 6 

-158. 6 

-168. 2 

9. 6 

3. 0 

6. 6 


Carrier 

8.3 

-158. 3 

-170. 8 

12.5 

6. 0 

6. 5 

E 

.Low- rate data 

8. 0 

-158. 0 

-167. 8 

9.8 

12. 0 

-2. 2 


PRIM ranging 

12. 9 

-162. 9 

-173. 8 

10. 9 

3. 0 

7. 9 


Carrier 

8. 9 

-158. 9 

-170.8 

11.9 

6. 0 

5. 9 
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2. 3. 4 Electrical Power and Distribution 


The Electrical Power and Distribution (EPD) System shall contain the 
capability to provide electrical energy and distribute this energy for opera- 
tion of the electrical and electronics systems throughout the ESS 24-hour 
mission. Internal energy sources are required to provide power from transfer 
to internal power through deorbit. Redundant and separate power sources 
and distribution bus systems will be utilized to comply with the ESS vehicle 
redundancy system concept. The ESS Phase A study evaluated various power 
sources and conducted a tradeoff that determined that silver zinc batteries 
will be used for the ESS 24-hour mission. Redundant static inverters will be 
utilized for DC to AC power conversion for all AC loads. 

Electrical Power and Distribution Requirements 

1* Provide a +28 vdc primary electrical power and distribution system 
capable of satisfying ESS system loads from internal power trans- 
fer through deorbit. 

2. Provide an ac power conversion system capable of operating from 
a +56 vdc input battery source to produce 115/200 vac, 3 phase, 

400 Hz power capable of satisfying ESS vehicle ac loads from inter- 
nal power transfer through deorbit. 

3. Redundant and separate dc power sources, ac power conversion, 
and distribution bus systems are required to satisfy the ESS vehicle 
redundancy system concept. 

4. Provide the capability for switching from ground power to ESS 
internal power. 

5. Batteries shall be sized and grouped for each of the redundant 
sources to handle the overall load from liftoff through deorbit for 
the ESS 2 4 -hour mission. 

6. Power sources and buses must be isolated and independent of each 
other during normal operation. 

7. Common loads shall not be connected to more than one bus 
simultaneously in order to prevent a single short to ground from 
pulling down two power sources. 

EPD System Description 

The primary +28 vdc electrical power system is shown in Figure 3-149. 
Tri-redundant and separate battery sources will be utilized to power three 
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main buses. Any two of the three +28 vdc sources will be capable of handling 
the total ESS electrical load. Each system contains a power transfer switch 
to transfer from external to internal power sources. Two ACT units are 
utilized for control and monitoring the individual +28 vdc power systems. 

Two power control solid state switches (PCS) are used per system to provide 
+28 vdc drive to the power transfer switch motor. 

Each 28 vdc system is controlled by redundant ESS computers via 
redundant data buses and ACT units. The power system as shown' in 
Figure 2-149 is connected to internal power. To switch main bus A to exter- 
nal power would require a computer address to ACT unit 1. The ACT output 
channel will provide a nominal +5 vdc at 10 milliamperes of current to 
provide input drive to PCS 1. The output of PCS 1 will switch +28 vdc to the 
motor of power transfer switch No. 1. The transfer switch is a make-before- 
break type that will switch to the external ESE ground power position. Backup 
manual commands will be provided by ESE through the umbilical connector 
to switch to external or internal power. The same procedure will be used to 
switch bus A to internal power using the computer. In this case, the com- 
puter will address ACT unit 1 and select PCS 2 to provide drive to the motor 
of transfer switch 1 in switching to internal power. 

Main bus B operation will be identical to that of bus A as previously 
described except ACT units 3 and 4 and PCS 3 and 4 will be used. Main bus 
C operation will also be identical to bus A operation as previously described 
except ACT units 5 and 6 and PCS 5 and 6 will be utilized. Each bus system 
will be monitored by individual ACT units. (ACT 2, 4 and 6) 

Nine batteries for the main 28 vdc system, will be sized and divided 
into three groups (3 per bus) so that a battery can fail in each group with no 
affect on the 24-hour mission power capability. One complete group of 
batteries for the main 28- vdc system could fail and the other two groups will 
handle the total ESS electrical load. Figure 2-150 shows a 28 -vdc load 
profile for 24 hours. 

Eight batteries (2 per bus) for the 56-vdc inverter power system will 
be sized and divided into four groups. Two 28-vdc, 200-ampere-hour 
batteries will be connected in series to each 56-vdc bus. Any two batteries 
have the capacity to handle the total peak load for one main orbiter engine 
during the 10 minutes from liftoff through main engine cutoff. Each engine 
will be connected to two separate 115/200 vac, phase 3, 400 Hz power 
sources. Each ac source is capable of handling the peak loads for one 
engine. AC loads for main propulsion system operation are shown in 
Figure 2-151. 


2-359 


SD 71-140-2 



TRIP IND 










SD 71-140- 


2800 - 
2600 ■ 
2400 

2200 
2000 
1800 
j- 1600 

5" S 1400 

5 » 
1000 
800 
600 
400 ’ 


SYSTEM 

GN&C 537 W FIRST 10 HRS , THEN 217 FOR 14 HRS 

DMC 1219 W FOR 24 HOURS 

COMM 116 W FOR 24 HOURS 

HEATERS 600 W AVERAGE FOR 24 HOURS 

INST 292 W FOR 24 HOURS 


2764 WATTS FOR FIRST 10 HOURS 
2444 WATTS FOR LAST 14 HOURS 


~2 4 6 8 10 12 14 16 18 20 22 

TIME (HOURS) 
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Figure 2-152 is a schematic block diagram of the 56-vdc bus distribution 
system. Figure 2-153 shows a schematic block diagram of the. 115/200 vac, 

3 phase, 400 Hertz system utilizing the 56 vdc bus input. 

The 56-vdc bus distribution system is shown in Figure 2-153. Opera- 
tion is identical to that of the 28-vdc system previously described. 

The 115/400-volt ac system shown in Figure 2-153 utilizes four static 
inverters. Each inverter is connected to a separate 56-vdc bus.. The output 
of the inverter is connected through a transformer to provide the 115/200 vac, 

3 phase, 400 Hz power. An ac distribution and control box will provide ac 
power transfer switching and control to the ESS vehicle loads. Figure 2-151 
depicts a timeline of the ac load required from transfer to internal power at 
liftoff through main orbiter engine cutoff. The peak ac load occurs during 
LH 2 recirculation when the engine nozzles are extended. During a single 
engine nozzle extension the peak ac load will be approximately 8. 5 kw for 
15 seconds. Each ac power source is capable of providing 10 kw for peak 
ac loads. The heavy ac peak loading will be completed at main engine cutoff, 
which ends approximately 10 minutes from liftoff. Each of the ac buses will 
be capable of handling the peak ac load during this 10 -minute period, 
including the 15-second period for nozzle extension. An ac bus is capable 
of handling the ac loads from main engine cutoff for the remainder of the 
24-hour mission. Table 2-33 indicates the energy per system used to 
arrive at the 56 vdc battery size. Table 2-34 shows the energy per system 
used to size the 28-vdc batteries. 

ESS Grounding System. The ESS vehicle grounding system will utilize 
the structure as a power return for the primary 28 vdc and 56 vdc power 
sources. The ESS grounding system will be compatible with the shuttle 
concept. The weight saving in power-return copper for the ESS vehicle 
structure ground return versus a single -point ground is estimated to be 
50 percent or approximately 350 pounds. Secondary power supplies and 
command/response signals will use a signal return. Signal return wires will 
be small gauge and lightweight. 

Figure 2-154 shows the structure grounding concept for the main 
28 vdc power system. The negative side of each battery will be connected 
to the main structure with a short, heavy gauge strap or wire. Figure 2-155 
shows the primary 56-vdc power system with the same structure grounding 
system as previously explained. 

Figure 2-156 shows one of the four ac power systems. The static 
inverter 56-vdc power input will be referenced to structure ground. The 
115/200 vac, 3-phase, 400 Hz, WYE transformer output will utilize a 
separate neutral wire from the output to the ac loads. 
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Table 2-33. 56-VDC Gauge Loading 


System 

Energy 

(watt-hour) 

Main engine (2) 

2716 

OMS engine (2) 

2810 

ACPS (14) 

17 

Actual total 

5543 

Add 40-percent spare capacity 

2217 

Actual + spare total 

Watt -hour . 

^ = ampere-hour (AH) 

7760 _ 1/1A ■ . 

- — ==140 ampere-hour 

5 6 

7760 

Note: Use two 28-VDC 200-ampere-hour batteries in series per bus 

because of peak loading during LHg r ecir culation for the main 
engine. 


Figure 2-157 shows the data bus command/response utilizing a signal 
return wire for commands and responses. The ACT unit contains an 
isolated 5-vdc power supply, which provides the 5-vdc driving commands to 
the solid-state power control switches. The 28-vdc input power to the 5-vol 
power supply is referenced to structure ground. The 5-vdc output commands 
are isolated from structure ground and provide a signal return for control 
and monitoring by the ACT units. The power control switch input command 
is referenced to the ACT unit 5-vdc signal return while the 28-vdc PCS output 
power is referenced to structure ground. The solenoid returns will be 
connected to structure ground. The 28-vdc position indicator switches will 
be monitored by the ACT unit. An isolation amplifier will be required to 
change the 28-vdc discrete, which is referenced to structure ground into a 
5 vdc signal, which is referenced to the 5-vdc signal return of the ACT unit. 
The signal return system described previously for Figure 2-157 is the 
preliminary approach recommended for the ESS vehicle data bus and ACT 
units to handle commands and responses. Other signal conditioning and 
measurements will be expteced to use a signal return in interfacing with the 
ACT units and data bus. 
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Table 2-34. Main 28-VDC Bus Loading 


System 

Energy 

(watt-hour) 

NG&C 

8,318 

DCM 

29,256 

Communications 

4,258 

Heaters 

14,400 

Propellant management 

7,448 

Instrumentation 

557 

Actual total 

64,237 

Add 40-percent spare capacity 

Watt-hour , 

— — - = ampere hour 

Volt ^ 

90,000 .... , 

^3210 ampere-hour 
2o 

25, 694 
89, 93 1 

Notes: 1. Use nine 500-ampere-hour, three parallel batteries per bus. 
2. Distribute loads evenly between buses. 


Redundancy. Three redundant and separate primary main 28-vdc buses 
and power sources will be used to comply with the ESS vehicle redundancy 
concept. Three batteries will be connected in parallel to one bus. The three 
buses normally will be isolated from each other; however, if one complete 
set of batteries should fail, the capability will be provided to remove the 
failed battery group from the bus and to connect all three buses together. 

The other two groups of batteries can adequately handle the load for the 
remainder of the mission. One battery in each group could fail and the other 
two in each group will handle the load. The loads will be evenly distributed 
between the buses. 
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Figure 2-156. ESS AC Power Grounding 
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Four redundant and separate 56-vdc buses and power sources will be 
used to handle the peak ac load during main engine operation and to comply 
with the ESS redundancy system concept. Each 56-vdc bus will provide 
input power to a static inverter. The 115/200 vac, 3 phase, 400 Hz power 
from each inverter will be used to satisfy the ac loads. One orbiter engine 
contains two separate and isolated ac power inputs. Each 10 kw static 
inverter is capable of handling the peak ac loads for one o rbiter. engine. Two 
static inverters could fail on one orbiter engine and with a one-engine out 
capability, the ESS vehicle would make mission and fail safe. 

ACT units are utilized to provide the computer with a rapid checkout 
and evaluation of the electrical power system. 

2. 3. 5 Electrical Controls 


Electrical control of mechanical and electrical subsystems is the 
function of the electrical components and circuits required to interface with 
the data and control management (DCM) system, acquisition, control, and 
test (ACT) units and the end devices to be controlled or monitored. The 
control requirements, functional elements, redundancy, and checkout of the 
following subsystems are described: 

1. Main propulsion 

2. Auxiliary propulsion 

Orbital maneuvering 
Attitude control propulsion 

3. Pressurization 

4. Propellant feed 

5. Propellant management 

6. Propellant dispersion 

7. Separation 

8. Safing 

9. Thrust vector 
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The mechanical components of these systems will only be discussed to 
the extent that they determine the operational requirements of the associated 
control circuits. Refer to the applicable mechanical system description for 
details pertaining to the mechanical components. 

Each of the system design concepts use common electrical components 
and circuit elements defined for the shuttle orbiter or Saturn S-H hardware 
of proven reliability. Wherever possible, Saturn S-II designs were used, 
with modifications to improve reliability and lower costs. The major forcing 
function for redesign of the electrical controls was the integrated avionics 
(IAS) /data bus concept that requires onboard computer control of electrical 
functions via a data-bus system; with ACT units as the interface with the 
electrical controls. The input-output requirements of these ACT units 
dictated a change from relay control elements to semiconductor switches, 
which require considerably less switching power. 

The typical power control switch (PCS) used in these designs is a 
semiconductor device with the following general characteristics: 


Terminal arrangement 

SPST (normally open) 

Rated operating voltage 

28 vdc 

Rated control voltage 

5 vdc 

Voltage drop 

0. 5 vdc maximum 

Power dissipation 

6. 5 watts 

Current rating 

7. 5 amperes 

Failsafe current 

30 amperes 

Trip circuit at 150-percent overload 


Trip indication voltage 

5 vdc 

Case operating temperature 

-54 C to +120 C 


These switches must provide internal protection against semiconductor short 
circuits which would allow an output without a command input, precluding the 
need for series redundant elements for short-circuit protection. 
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Each subsystem redundancy determination has been based on components 
and power sources only. Wire paths are not considered as a source of 
failure modes. Components with Saturn- Apollo reliability do not require 
alternate paths. Off-the-shelf or shuttle hardware does require alternate 
paths to obtain the necessary reliability. 

Following are detailed analyses of each of the avionics /nonavionics 
elements providing the requirements, description, analysis, and checkout of 
each subsystem interface. Schematic diagrams are provided to aid in 
understanding of system operation. 

Main Propulsion Electrical Control 

The ESS main propulsion electrical system is designed to interface the 
ESS DCM subsystem with the space shuttle engine electrical system and to 
control application, electrically, of the two main propulsion system engines. 

It is assumed in this discussion that the proposed Rocketdyne space shuttle 
engine is used as the basis for the design of the vehicle MPEC's. (Refer to 
ICD 13M15000B. ) 

Requirements. 


1. The ESS engine EC system will be FO/FS. 

2. The ESS engine control system will use the data bus concept. The 
data and control management subsystem data bus and ACT units 
will be utilized to provide commands, timing, and .s equencing to 
the SSE. 

3. The vehicle engine control system will be designed to allow check- 
out of the system with an automatic computer-controlled program. 

4. The vehicle engine electrical control system will control redundant 
115/200-volt, 400-Hz, 3-phase power to each engine. There is 

no engine requirement for dc power. 

5. The vehicle can be placed in a safe condition with one engine out. 

6. The ACT units, power transfer switch, and power control switches 
(PCS) will be identical to those used for similar applications on 
the shuttle program. 

System Description . The Rocketdyne shuttle orbiter engine is controlled 
by an electronic controller that utilizes redundant digital computers. Com- 
munication with the vehicle is via the engine data bus. (See Figure 2-158. ) 
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The engine accepts commands from th‘e vehicle and transmits data to the 
vehicle as controlled by the ACT units. 

Power for all components in the engine is controlled by the vehicle 
engine EC system (Figures 2-158 and 2-159). The vehicle engine EC system 
controls the redundant power sources to the engine electronics package. 

The engine control and monitor system is fail-operational upon loss of either 
power source. If both power sources fail, the engine has the capability to 
be shut down at once or up to 40 seconds later. The time to shutdown must 
be determined and set into the engines on the ground. 

The engine electrical interface consists of six connectors. Two con- 
nectors are used for commands and vehicle-requested engine status; two 
connectors are used for power input; one connector is used for instrumenta- 
tion; and one connector is used for ground measurements (Figure 2-158). 

The vehicle engine control system will use two ACT units per engine. 
One ACT unit will give commands and receive data through one engine com- 
mand connector, and one ACT unit will give commands and receive data 
through the other engine command connector. The two -engine-mounted, 
digital computers interface with each command connector and have the capa- 
bility to control the engine from either interfacing ACT unit (Figure 2-158). 
Each ACT unit is powered by a subbus of two batteries, see Figure 2-159. 

This enables the loss of two of the three 28-volt main buses and still retain 
capability to control the engine. 

Engine operation can be divided into six phases as follows: 

I 

1. Ground checkout . The automatic mode sequentially checks con- 
troller, sensors, actuators, valves, and spark igniters. Individual 
checkout of components is possible. 

2. Start preparation. Controls purge operations and verifies engine 
readiness prior to start. 

3. Start . Controls and monitors the engine during the start sequence. 


4. Main stage. Controls and monitors engine performance, limit 
control, valve positions, and maintenance data. 

5. Shutdown. Controls and monitors the engine during the shut-down 
sequence. 

6. Post shut down . Controls and monitors the engine during propellant 
dumping operations. 
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The commands for control of the engine are listed in Figure 2-159. 

The engine operation phase in which each command is normally required 
and the phase in which the command is accepted are indicated in the Fig- • 
ure 2-159* The engine will not accept commands during engine operation 
phases in which engine integrity could be violated, or damage to equipment 
or injury to personnel could occur. 

The vehicle engine control system will control power from two parallel 
inverters and supply it to the engine on two separate power connectors 
(Figures 2-158 and 2-159). Both inverters may be turned on at the same 
time. The engine should contain provisions to prevent tie’ing the power 
together internally. Each inverter bus will be switched by two power trans- 
fer switches in series. Each power transfer -switch is controlled by a power 
control switch, which in turn is controlled by the -ACT unit, see Figure '2- 158. 
Power will be .applied to the engines on the ground and removed from the 
engines after engine cutoff. The system is so designed that any combinations 
of two main dc buses or ac buses, two ACT units or transfer switches, 'or 
engine computers could fail and at least one engine would remain operational. 

■ The vehicle engine control system makes use of the capability of ACT 
units to completely checkout redundant paths and isolate failures to a 
single component with the onboard central computers. " Figure 2-160 indicates 
the measurements necessary for checkout. 

The engine has the capability to check itself and if a malfunction is 
detected during the test sequence, the type of malfunction and the failed line 
replaceable unit (LRU) are identified via the data bus. 

Trade Studies and Performance Analysis. The decision to use the data 
bus concept versus discrete command wiring was made at the beginning of the 
Phase B Study. See paragraph 2. 3 of this section for the ground rules under 
which the trade study was conducted. 

The redundancy level required in each portion of the system was deter- 
mined by the FO/FS ground rule. During the proposed design, the following 
three basic ground rules were applied in an attempt to ensure proper per- 
formance during flight and ground checkout: 

1. Use the properly sized components to provide for adequate 
performance. 

2. Add necessary redundancy to meet the FO/FS performance 
requirements. 

3. Add necessary checkout capability to verify all redundancy and 
isolate failures to the component level. 
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Redundancy Management . Redundancy management techniques for the 
vehicle engine control system consist of the following steps to ensure the 
system meeting the FO/FS system requirements: 

1. Design in redundant paths with adequate checkout capability to 
check out each path and isolate failure of the replaceable black 
box. 

2. Check out all combinations of the redundant paths during ground 
checkout. 

3. Apply the necessary commands to activate all the paths prior to 
flight or ground testing. 

4. Monitor each path for its proper signature in flight or ground 
testing and turn off any failed component. 

Auxiliary Propulsion Electrical Controls 

The ESS auxiliary propulsion electrical controls (APEC) provides the 
dual function of orbital maneuvering system (OMSEC) and attitude control 
propulsion system (ACPSEC) electrical controls. In this orbital maneuver- 
ing modes, the system utilizes two LOg/LH^ 10, 000-pound thrust engines to 
provide the velocity changes necessary for orbit circularization, orbit 
transfer, rendezvous, and deorbit. For attitude control, the system utilizes 
fourteen GC^/GHg 2100-pound thrust engines. The propellant feed, pressuri- 
zation, and propellant management subsystems are common for the total 
APS system. 

Requirements. 


1. Control circuits for each APEC function will be FO/FS, and the 
FO/FS design concepts will be based on total engine systems 
requirements with consideration for each critical mission phase. 

2. ACPS and OMS engine sequencing will be accomplished by the DCM 
system. 

3. APEC circuits will utilize control hardware being developed for 
the shuttle orbiter, including ACT units, power control switches, 
and engine control drivers. 

4. ACPS minimum impulse firing time shall be approximately 
100 milliseconds. 

5. The APEC subsystem shall be designed for checkout by an automatic 
computer program. 
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System Description . The APEC's are composed of pressurization, 
propellant feed, ACPS, and OMS subsystems. The pressurization and 
propellant feed system is composed of the functional elements required to- 
manage the liquid and gaseous propellants required for ACPS or OMS engine 
operation. Refer to Figure 2-54 for a mechanical component block diagram 
of the systems and Figure 2-161 for the typical electrical control block 
diagram. 

Each APS liquid propellant tank has two independent, electrically 
actuated, fill valves in series; each valve requires three alternate electrical 
control paths in order to achieve FO/FS actuation. Although these valves are 
only actuated during ground operations, they are critical if ground emergency 
conditions require draining propellants from the tanks. 

Like the fill valves, there are two valves in series, for control of APS 
ground pressurization of each gaseous propellant system (GHg and GO 2 for 
the ACPS). These valves are not critical because the gases may be vented. 
The control circuits are, therefore, only two alternate paths since the second 
failure would be a safe condition. 

The LO^ and LH^ APS prevalves are also two valves, in series, in 
each propellant feedline and considering that a one OMS engine-out condition 
is safe, the valve control circuits need two alternate paths. 

Hot gases from the gas generators drive the turbopumps and then exit 
through two propulsive or nonpropulsive vents. A pneumatic, normally closed 
pilot operated valve for each system selects either vent mode. These pilot 
valves are critical for APS operation and therefore require two alternate 
paths for solenoid controls. 

The gas generator isolation valves shut off the supply of gaseous 
propellants to the engine gas generator supply manifolds. Two alternate 
paths for control of each of these eight valves are sufficient to achieve FO/FS 
actuation. This is based on the ability of one OMS engine to complete a 
mission, which means the loss of one OMS engine is a safe condition. 

Each liquid propellant tank has one controllable vent relief valve with 
an isolation valve in series with it and one noncontrollable relief valve and 
burst-disc combination. The controllable vent relief valves are similar to 
the ones used on the Saturn S-II propellant tanks. They have electrical con- 
trol to open the vent and control to override the normal relief pressure 
setting. The solenoid that opens the vent is a normally open valve so loss of 
control power would open the vent when pneumatic pressure is applied; 
therefore, two control circuits for this valve yield FO/FS actuation. The 
override solenoid is normally closed so loss of control power to this valve 
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Figure 2-161. ESS Auxiliary Propulsion Electrical Controls 
(Triple Redundant Valve Control) 
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is also a safe condition. Also, this override solenoid has no operational 
function; therefore, only one control, path is required. The vent isolation 
valve located in series with the relief valve requires two control circuits 
to meet the FO/FS requirement associated with the relief valve installation. 

The gaseous propellant accumulator relief systems differ from that of 
the liquid propellant tanks in that the relief valves are not controllable and 
there are three parallel relief valves - one has two series isolation- valves ; 
one has one series isolation valve, and one has a series burst disc./ Since 
the systems are mechanically FO/FS for relief capability, the isolation 
valves must protect against a failed-open relief valve. Two control paths 
for each of these isolation valves satisfy the FO/FS criteria for this failure 
mode. 


Pressure switches and pressure transducers are required for 
monitoring and control purposes. All critical measurements are FO/FS, 
but those used only for data are single circuits; the same is true for 
temperature, flow, and speed measurements. 

Preparation of the APS system for operations will start with pressur- 
izing the accumulators through the ground pressurization valves and purging 
the LOg and LHg tanks. The L Og and LHg vent isolation and vent relief 
valves are open and the fill valves are partially opened until chilldown of the 
tanks is accomplished; the fill valves are then opened full open for fastfill. 
With the propellant tanks loaded (refer to Section 2. 3. 5 under Propellant 
Management Electrical Control Subsystem for propellant loading and level 
monitoring electronics), the vents are closed and the tanks are pressurized 
through the pressurization shutoff valves and regulators from the stored 
gaseous propellants in the accumulators. The prevalves, gas generator 
isolation valves, and the ACPS manifold isolation valves are opened and the 
OMS engine system is preconditioned. The APS system is then ready to 
operate when commanded by the DCM system. OMS engine main propellant 
valves and gas generators are controlled by driver units similar to the ACPS 
thruster driver shown in Figure 2-162. The three-way OMS or ACPS mode 
select valves and hot gas vent select valves are individually controlled as are 
those turbopump unloading (bypass) valves. Each of these circuits for OMS 
control consists of two alternate paths - for each function - to achieve FO/FS 
operation; separate power sources are utilized for each alternate path of each 
function. OMS engine start is accomplished by positioning the three-way 
select valves to propulsive vent and OMS engine operating position, starting 
the gas generators to drive the turbopumps, initiating OMS ignitors, opening 
the main propellant valves, and closing the turbopump unloading valves. 

The ESS ACPS will be used intermittently throughout the ESS mission 
from separation through deorbit. Figure 2-163 shows the electrical control 
schematic block diagram for one group of seven thrusters. Figure 2-164 
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Figure 2-162. Attitude Control Propulsion System. Electrical 
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Figure 2-164. ESS Auxiliary Propulsion System (Attitude Control) 


2-390 


SD 71-140-2 









indicates the physical layout and manifolding of thrusters in a group. 

Thruster Engines 1, 2, and 3 are connected to the same fuel and oxidizer 
manifold. Engines 4 and 5 are connected together and likewise Engines 6 
and 7. Figure 2-162 is a schematic block diagram of the attitude control 
driver unit that provides the control and sequencing to -the thruster engine. 
Each thruster has one GOg and one GHg 28-vdc solenoid-operated valve. 
Redundant spark exciters are included to assure ignition. 

The LC >2 and LH 2 prevalves are normally open and four gas generators 
are operating for an ACPS mode. The ACPS E.C operates with a computer 
address via redundant data buses to an attitude control driver ACT unit. 
Previously, before liftoff, standby ac and dc .power has been applied to each 
driver unit. GOg and GHg have been manifolded to each thruster valve via 
two isolation valves, in seri.es, and each thruster is ready to fire when 
selected by the computer via the data bus and driver unit. Each attitude 
control driver unit contains triple redundant circuitry. Operation of one 
thruster engine begins with an address to the driver ACT unit. The ACT 
unit output channel will provide the input signal to the predriver amplifier 
which will switch the -solid-state driver output to 28 vdc. The driver will 
energize the thruster GO 2 and GHg solenoids causing the valves to open. 

A 25-millisecond signal is provided to the engine spark exciters for ignition. 
The thruster will continue to burn until the solenoid is deenergized by com- 
puter removal of the 28 vdc from the driver. This will cause the normally 
closed- GOg and GHg valves to close, terminating burn time for a thruster. 

A minimum-impulse command can be issued by the computer. In this case, 
the ACT unit output fires a one-shot multivibrator located in the attitude 
control driver unit that provides the predriver with an input signal which, in 
turn; causes the driver to open the thruster's GOg and GHg valves for the 
length of time the one-shot is on. The ESS minimum-impulse firing will be 
approximately 100 milliseconds. The computer command to fire a thruster 
longer than a minimum-impulse duration will require the computer to issue 
a start command and later to issue a stop command. An assumption is made 
that the 25 millisecond spark ignition time will not require the computer to 
issue a turn-off command. 

The attitude control driver unit electronics contain signal conditioner 
buffer amplifiers used to condition and normalize ac, analog, and low-level 
secondary signals to a level acceptable by the ACT unit. The thruster engine 
will contain pressure transducers used to detect and monitor pressures and 
pressure differentials to evaluate thruster performance. 

An enable signal to each engine attitude control driver unit provides 
ac and dc power to the driver electronics for each thruster addressed. 
Subsequent discrete thrust commands provide either direct input to the pre- 
driver, or minimum-impulse input via a one-shot circuit. The predriver 
circuit contains input gating and power gain to the PNP driver transistors, 
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which in turn switches the current to the GH£ and G0£ engine valve solenoids. 
Separate hardwire connections are provided to each thruster valve solenoid. 
Transient suppression circuitry will be provided to reduce to a manageable 
level the inductive kick generated by a coil current turnoff. A separate 
ignition signal feeds a second 28-vdc driver circuit to provide a low-power 
discrete signal to the ignition exciter, which is part of the engine system. 
Interface with the data bus is provided by ACT units contained in the attitude 
driver units. 

Four basic discrete signals are used to control each thruster engine: 

(1) channel enable, (2) valve command-normal, (3) valve command-minimum 
impulse, and (4) ignition on command. In addition, each ACT unit accom- 
modates four discrete signals from each engine control channel to verify the 
following four functions: (1) channel bias voltage, (2) coil driver on, 

(3) ignition signal on, and (4) engine on. 

Multiple isolated dc and ac power lines are required for redundancy 
management and fault tolerance. Each ac line serves a separate bias supply, 
and each dc line is provided with an EMI suppression filter. 

Redundancy. 


1. Power . Three redundant 28-vdc and 115-vac, 1 -phase, 400 -Hz 
sources will be utilized for the attitude control driver units to 
control and power the ACPS engines as indicated in Figure 2-163. . 

2. Component . Triple redundant attitude control driver units will be 
used to meet the fail operational/fail safe concept for the OMS/ 
ACPS engines. 

3. Failure mode analysis . Triple redundant attitude control driver 
units including integral ACT units will be used to assure OMS/ 
ACPS engine firing capability. In addition, redundant data buses 
and computers are available to address the driver units. 

Monitoring of the OMS / ACPS engines will be via the attitude driver 
units, which will provide triple redundancy for engine performance 
evaluation or fault isolation. 

4. Management requirements . Separate and triple redundant power 
and driver units are available for each OMS/ACPS engine, which 
will facilitate rapid computer control for determining response to 
an individual OMS or ACPS engine. This arrangement will allow 
rapid fault isolation in the case of no response from a commanded 
engine. Commanding and monitoring other OMS/ACPS control 
driver units will provide fault isolation to a completely failed ACT 
unit, driver electronics, or the OMS or ACPS engine. Three 
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failures in the same driver electronic circuitry in three separate 
black boxes will be necessary to cause an OMS/ACPS engine 
failure due to the driver circuitry. 

5. Backup modes. Completely separate and triple redundant power 
sources and driver electronics provide adequate backup modes 
inherent in the design of the OMS/ACPS engine control. 

Propellant Feed Electrical Controls 

i 

The propellant feed electrical controls (PFEC) are designed for the 
following electromechanical devices. 

1. Propellant tank fill and drain valves 

2. Engine feed prevalves 

3. Recirculation valves 

The purpose of the PFEC is to control transfer propellants to the stage 
main propellant tanks ; from the tanks to the engines or drain the tanks; and 
temperature condition the feedlines and engine components by recirculation 
of propellants. 

The transfer of propellants to or from the stage is accomplished through 
pneumatically actuated, solenoid-controlled butterfly valves (fill and drain 
valves). These valves are normally closed and are actuated during propellant 
transfer operations. Pneumatic pressure for actuating these valves is 
supplied from a ground source only. 

Propellants are transferred to the engines through the engine feed 
system normally open, pneumatically actuated, solenoid-controlled prevalves. 
Should loss of pneumatic pressure or electrical control power occur, the 
prevalves are spring -actuated to remain in the open position. There are 
four prevalves, one for each propellant feedline to the main engines. 

Pneumatic actuation pressure for these valves is supplied by the valve 
actuation helium receiver. 

Recirculation of propellants through the engines and back to the tanks 
temperature conditions the system to obtain the required engine inlet 
conditions. The LO^ recirculation is accomplished by bubbling ambient 
GHe through the liquid in the feed system to augment natural convection. 

EHg is recirculated by an engine-provided, electrically driven pump, pumping 
the liquid through the system. Each system (LOg and EHg) has a propellant 
return line back to its respective tank and a normally open, pneumatically 
actuated, solenoid-controlled recirculation valve in each return line. 
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Each LOg feedline has an accumulator for pogo oscillation suppression. 
These accumulators are supplied with helium pressure from the GHe injection 
receiver to damp LOg oscillations in the feedlines during engine operation. 
Each accumulator also has a bleed valve connecting it with the recirculation 
return line. These valves are normally closed, pneumatically actuated, and 
solenoid-controlled. During recirculation they are opened. 

Requirements. While mated to the booster, all electrical control 
circuits must be capable of sustaining two component failures and still be 
safe. If the controlled function fails to a safe condition when control power 
is lost, only two control paths are required. If the failure mode of the 
controlled function is not fail-safe when power is lost, three independent 
control paths are required. When a function becomes unsafe if control power 
is applied at the wrong time, each independent path must be protected against 
inadvertent power application. 

Measurements considered critical to the operation of the vehicle and 
safety of the crew must also be redundant to obtain FO/FS op'eration. 

Wherever possible, solenoid and pneumatic valves will have a position 
indicator for performance monitoring and failure' isolation. 

System Description. Each component of the system has individual 
operating characteristics and failure mode effects that determine the circuits 
required to obtain the FO/FS goals. Each one is considered and described 
as a separate system. 

Semiconductor power switches are utilized in each of the control cir- 
cuits in order to interface with the ACT units. This is the same approach • 
and hardware used on the shuttle orbiter. 

Transducers and signal conditioning are shown as system requirements. 
Refer to the instrumentation section for hardware descriptions. 

1. The LOg and LHg fill and drain valves are normally closed 
pneumatic valves, actuated both open and closed by two-way 
solenoid valves whose normally open ports actuate the valves 
closed. FO/FS for the valve control circuits is applicable only 
on the ground because pneumatic actuation pressure will not be 
available after liftoff. Three data bus control circuits are 
required to obtain FO/FS operation of the control circuits. Refer 
to Figure 2-165 for the circuit block diagram. 

2. The LOg and LHg prevalves are normally open,- pneurriatically 
actuated valves located in each engine propellant feedline. Each 
valve is pneumatically actuated both closed and open by an 
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electrically controlled two-way solenoid valve- When the solenoid 
is energizedj the prevalve is closed and when the solenoid is deen- 
ergized, the prevalve is pneumatically actuated to the normally open 
position. 

A control circuit failure that will not allow the prevalves to be 
closed is not considered a critical failure; therefore, only two 
control circuits are required. A failure that would close a prevalve 
prematurely would be critical if prevalves on two engines were 
affected. Dual circuits for each prevalve gives FO/FS operation. 
Refer to Figure 2-166 for the circuit block diagram. 

3. Control circuits for the recirculation return line valves (recircula- 
tion valves) must be FO/FS for failures that would energize the 
solenoids to close the valves but only FS for other failures. This 
is because an open valve is a safe condition but a closed valve 
could result in engine failure. A single control path satisfies the 
requirement. Refer to Figure 2-167 for the circuit block diagram. 

4. The LO^ helium injection solenoid is normally open and must be 
energized closed. A failure that would energize the valve closed 
could cause engine failure but a valve failed open would be a safe 
condition. A single control path gives FO/FS operation for this 
valve. Refer to Figure 2-167 for the circuit block diagram. 

5. The pogo accumulator fill control solenoids supply GHe to the 
helium injection system when deenergized and to the LO^ feedline 
accumulator when energized; therefore, the system must be FO/FS 
in both the opening and closing modes. Since there are two sole- 
noid valves in parallel, the control circuit for each valve must 
have two independent paths to obtain FO/FS operation of the 
combination system. Refer to Figure 2-168 for the typical block 
diagram. 

6. The pogo accumulator bleed valve fails both operational and safe 
in the open position but a failed-close condition could affect 
engine start. The control circuit for this valve is a single path. 
Refer to Figure 2-169 for the circuit block diagram. 

7. The instrumentation associated with the propellant feed system is 
primarily for performance evaluation but will also be used for 
fault isolation during checkout operations. The pressure and 
temperature transducers are also to be used as backup measure- 
ments for the position indicators on the pneumatic valves and 
solenoids. The only critical measurements which must be 
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Figure 2-166, Typical Prevalve Control Block Diagram 
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Figure 2-167. Typical Recirculation Valve and Helium Injection 
Solenoid Control Block Diagram 
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Figure 2-168. Pogo Accumulator Fill Valve Control Block Diagram 
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Figure 2-169. Pogo Accumulator Bleed Valve Control Block Diagram 
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redundant are the engine inlet pressures and temperatures. Other 
measurements associated with the system are redundant to each 
other and/or they are noncritical. 

The signal conditioning equipment for each measurement must 
have a 0 to 5-volt-dc output compatible with the ACT unit interface 
requirement. 

Performance Analysis. The redundancy level required in each portion 
of the system is determined by the operating requirements of each function. 
The failure modes and criticality of each mode differs with each component 
being controlled. The redundancy required to obtain the required FO/FS 
operation of each control circuit is discussed in the previous section. 

Failure modes and their resulting effect on system operation are also 
discussed. 

Management requirements, based on the required subsystem operation, 
are determined by the available alternate paths and status monitoring 
capability. During operations other than checkout, a status check and profile 
comparison will be required repetitively, at fixed intervals. A discrepancy 
will require immediate corrective action to isolate the failed component and 
select an alternate mode. 

1. A propellant tank fill valve has three alternate paths for operation. 
One path will be used as the primary mode until a failure occurs. 
While this path is energized, the computer will compare the 
status indicators with the required profile. 

a. Fill valve open indication ON 

b. Fill valve solenoid open indication ON 

c. Power control switch 3 output ON 
■d. Fill valve closed indication OFF 

e. Fill valve solenoid closed indication OFF 

f. Trip indicators 1, 2, and 3 OFF 

A comparison failure of any one of the indicators alone will only be 
reverified for a predetermined number of samples and then 
telemetered as a nonfunctional indicator failure. 

A comparison failure of two or more indicators for a predeter- 
mined number of samples will require that the computer select an 
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alternate path and isolate the failed path. The failure information 
will be telemetered as performance data. Other control circuits 
will be handled in a similar manner. Checkout of these circuits 
requires actuation and verification of each redundant path. 

Pressurization Electrical Controls 

The pressurization electrical controls (PEC) is divided into four 
categories: 

1. and LH-> propellant tank vents 

2. LOg and LH 2 propellant tank pressure switches 

3. LOg and LH 2 tank GHe pressurization solenoids 

4. Valve actuation GHe receiver vent 

The purpose of the system is to assure that a net positive suction pressure 
(NPSP) is provided for the engine turbo pumps, that a positive pressure is 
maintained in the propellant tanks, and that gaseous helium pressure -is 
available for pneumatic valve actuation. 

. During ground checkout and standby operations, the stage pressuriza- 
tion solenoids, in conjunction with the propellant tank pressure switches and 
the DCM system, control pressurization of the tanks to one-half flight 
(people-safe) pressure. Before liftoff, ground sources pressurize each tank 
to flight pressure. After engine start, pressurant gases are supplied from 
the main engines. 

Requirements . The LO 2 and LHg main propellant tank vent valves are 
controllable mechanical relief valves that vent at predetermined pressures. 
They must have electrical control circuits to actuate the valves open pneu- 
matically, to override the normal relief pressure setting, and the LH^ vents 
must have an electrically controlled low-pressure vent mode, solenoid. 

FO/FS control circuits are required for each of these solenoids. After 
liftoff, electrical control is required for the LHg vent valve low-pressure 
vent mode solenoids only. 

Each propellant tank has three pressure-actuated switches which are 
used, for control of tank pressurization during ground operations. One low- 
pressure and two flight-pressure switches monitor tank pressures. They 
must be used to control pressurization to safe ambient pressure and flight 
pressures. The normally closed tank pre-pressurization solenoids must be 
interlocked with these pressure switches by the computer software program. 
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The valve actuation GHe receiver supplies pneumatic pressure for 
actuation of pneumatic valves which must operate in flight. The vent valve 
on this receiver is for ground operations only. It is a normally closed 
solenoid valve that requires only fail operational control capability due to its 
noncritical function. 

System Description. Each component of the system has individual • 
characteristics and failure mode effects that determine the electrical control 
circuits required to obtain the astrionics reliability required. The control 
switching is accomplished by semiconductor power-control switches which 
interface with the DCM system ACT units and the mechanical system solenoid 
valves. These are the same PCS's proposed for use on the shuttle orbiter. 

All instrumentation equipment required for performance evaluation, 
checkout, and fault isolation in this system is noted and included in the 
measurement list. A description of the hardware required to implement 
these measurements may be found in Section 4. 3. 3. 

Main LO;? and EH^ Propellant Tank Vent Valves. The vent relief valves 
on the main propellant tanks (two on each tank) are automatic pressure relief 
valves with pneumatic controls to open, select the reference pressure, and 
override the relief pressure setting during ground operations. Each vent 
valve has a normally open solenoid that supplies GHe pressure to actuate the 
valve open. If control power to this solenoid is inadvertently removed, the 
vent valve is forced open by GHe pressure. This failure mode is a safe 
condition. Each vent valve also has a normally closed solenoid to override 
the relief setting for checkout, and a low-pressure vent mode select solenoid 
to reduce the tank relief valve pressure setting after MPS engine start. 

Only the low-pressure vent mode select solenoid is used during flight; the 
other control solenoids are used only during ground operations. 

The control circuits for each of these solenoids must be two alternate 
paths to obtain FO/FS operation. This requirement is satisfied by one 
avionics path and one hardware path for the normal-close and override- 
close solenoids, and two avionics paths for the low-pressure vent mode sole- 
noids. Hardwire control is considered necessary for standby operations 
when the DCM subsystem is not available. (Figure 2-17 0 presents a block 
diagram of the circuit.) Only the low-pressure vent mode solenoids require 
redundancy management switching to alternate paths. 

Propellant Tank Pressure Switches. Each of the three pressure switches 
on each propellant tank are wired to two ACT units. This, plus the backup 
pressure monitoring of the pressure transducers, gives a two- and three- 
failure tolerance for the 8 psig and flight-pressure switch, pressure- 
transducer combination. (Figure 2-170 shows the circuit diagram.) 
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$V1 - NORMAL CLOSE SOL. 

SV2 - OVERRIDE CLOSE SOL. 

MS - POSITION INDICATOR 

PAC - POWER CONTROL SWITCH 
P - PRESSURE TRANSDUCER 

1. - PCS TRIP INDICATION 

PCS 2. - LOW VENT MODE CMD 

3. - CMD VERIFICATION 
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Figure 2-170. Typical Vent Valve Control Block Diagram 
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L O 2 and LHg Pre-Press Solenoids. These solenoids require only two 
control paths through the data bus system because the ground-controlled 
auxiliary pressurization system is a backup mode that may be utilized. 
Electrical control of these valves is terminated at liftoff; therefore, during 
the operational time line, the system is FO/FS for each valve. (Figure 2-171 
presents the circuit diagram.) Since this circuit has two control and feed- 
back paths, redundancy management will be required in the DCM system. 

Valve Actuation GHe Receiver Vent Valve. The control circuit for 
this valve is identical to the circuit for the pre-press solenoid valves shown 
in Figure 2-171. This solenoid is used only during ground operations, and 
a failure of the valve to operate open can be resolved by manually bleeding 
the receiver. Two control paths give FO/FS operational redundancy. This 
circuit also requires redundancy management in the DCM system. 

Instrumentation. Pressure measurements are required for performance 
monitoring and failure isolation. Tank pressures are redline "critical" 
measurements and therefore triple paths are provided to achieve FO/FS 
redundancy level (See Section 2. 3. 6 for a description of typical transducers 
and signal conditioning equipment. ) 

Performance Analysis. The redundancy level required in each portion 
of the system is determined by the operating requirements of each function. 

The failure modes and criticality of each mode differ with each component 
being controlled. The redundancy required to otbain FO/FS operation of 
each control circuit has been discussed in the previous section. Failure 
modes and their resulting effect on the system operation were also considered. 

Redundancy management requirements, based on the required system 
operation, are determined by the available alternate paths and status 
monitoring capability. During operations other than checkout, a status check 
and profile comparison will be required repetitively at fixed intervals. A 
discrepancy will require immediate corrective action by the DCM system to 
isolate the failed component and select an alternate operational path. 

The valve actuation helium receiver vent valve has two operational 
paths for control and monitor functions. One path will be used as the primary 
path during operations until a failure occurs. The computer in the DCM 
system will monitor the performance of the valve and circuits by comparing 
the status indicators with the desired system profile. 

1. Solenoid open indication ON (1 and 2) 

2. Solenoid closed indication OFF (1 and 2) 
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Figure 2-171, Typical LO 2 /LH 2 Pressurization Solenoid Control 

Block Diagram 









3. Power control switch, output ON 

4. PCS trip indication OFF 

A comparison failure of one indication will be reverified for a predetermined 
number of samples and then be telemetered as an indicator failure. A failure 
of two or more indicators for a predetermined number of samples will cause 
the DCM system to sele,ct an alternate path, isolate the failed path, and 
telemeter the failure information. 

Other control circuits will be handled in a similar manner. The 
sequence of events and control switching will be determined by the require- - 
ments of the particular function and the available alternate modes of the 
control circuits. 

Checkout of redundant circuits will require sequential actuation and 
reverification that all components are operational and controllable. 

Propellant Management Electrical Control Subsystem 

The primary purpose of the propellant management electrical control 
subsystem (PMECS) is measurement of propellants while loading the MPS 
and APS engine fuel tanks and for depletion cutoff. After ESS boost and during 
the remainder of the mission, the system provides telemetered data on main 
tank residuals and APS propellant reserves whenever slight acceleration is 
induced to settle propellants. Both analog and discrete measurements are 
provided, with sufficient redundancy to assure FO/FS operation for propellant 
loading and depletion cutoff. The addition of a zero-g measuring system for 
monitoring the APS propellant reserves in orbit was considered and rejected 
because of development costs and the existing capability to apply low-thrust 
levels to settle propellants. 

The ESS will fly with the main engine PMR valves locked in the 6:1 ratio; 
therefore the propellant utilization capability inherent in the system is not 
us ed. 


Requirements . PMEC requirements are: 

1. FO/FS measurement of propellants, with a 0. 2-percent-of-full 
load accuracy must be provided for propellant loading purposes. 

2. The system must be capable of providing in-flight data on 
propellant reserves. 
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All in-tank equipment must be compatible with the cryogenic 
environment and must not be capable of producing ignition energy 
in a liquid or gaseous environment. 

4. Propellant depletion must be indicated when any propellant tank 
reaches a predetermined low level-. 

System Description. The ESS PMECS retains the Saturn S-II concepts 
and most of the hardware to provide the capability and flexibility of wide 
variance in tank loading which is dependent on the payload and mission. An 
improvement in reliability and lower cost was obtained by incorporating a 
new electronics package in place of the computer used on S-II. The additional 
equipment required for the APS propellant measurements is the same as 
used for the main propellant tanks except the capacitance probes are smaller. 

The short-circuit design of all in-tank equipment and interfacing 
external equipment will assure that stoichiometric values are well below the 
energy levels required to initiate LOg ignition. 

Each of the seven propellant tanks, main LO 2 and LHg and APS LO 2 
and LiHgj-has an analog measurement system and discrete level sensors for 
propellant loading and level monitoring. The analog systems are composed 
of capacitance probes with electronic circuits to develop an analog voltage 
output proportional to the capacitance of the probe, which has a variable 
capacitance dependent on the liquid level in the tank. (Figure 2-172 presents 
a typical circuit block diagram of the capacitance system electronic circuits. ) 

The major components of the analog measurement systems are described 
in the following paragraphs. Since the capacitance level monitoring system 
is primarily for propellant loading, the APS liquid hydrogen four-tank 
arrangement has a capacitance probe in the fourth tank only. The level in 
the first three tanks is monitored by point-level sensors only. 

Point Sensors. The point sensors give discrete level indications of 
the liquid in each propellant tank. The main LOg tank has eight sensors 
mounted near the top of the tank for loading purposes and two near the bottom 
to assist in residual calculations as well as propellant loading. The main 
LH 2 tank has five sensors mounted near the top of the tank and two near the 
bottom. 

The point sensor system, known as a "hot-wire system", consists of 
sensors and an.electronic controller assembly for each sensor. The sensing 
element is a gold plated platinum wire carrying a constant current. As the 
sensor is covered by a cryogen, the resistance of the wire element drops 
sharply and the voltage across it drops. The controller assembly senses the 
voltage change and actuates an output relay that provides a discrete 28-vdc 
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Figure 2-172. Propellant Loading Electronics 
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output. No direct command control is required for this system except power 
application and checkout simulation commands. Sensor locations in the main 
and APS propellant tanks are illustrated in Figures 2-173 and 2-174. 

Figure 2-175 is a schematic diagram of a sensor controller assembly. A 
typical control, checkout, and monitor diagram is shown in Figure 2-176 
for all hot-wire sensors. 

Depletion Cutoff Sensors. Propellant depletion engine cutoff sensors 
are located near the feedline outlet in each main propellant tank and near the 
APS prevalve in the APS LOg tank and the APS LHg tank. Four hot-wire 
sensors are mounted around a pedestal in the bottom of the main LOg tank, 
the APS LOg tank, and the APS LHg tank; the main LHg tank has two of the 
sensors on either side of each feedline exit. The sensors and controller 
assemblies are the same as used for the level monitoring system. The 
location of these sensors is shown in Figures 2-173 and 2-174. The circuit 
is the same as shown in Figure 2-176. 

Performance Analysis . The capacitance probe mass -sensing systems 
provide an analog measurement of the propellant level from empty to full. 

The point sensors provide discrete level measurements which are backup 
measurements for propellant loading, the most critical function of the 
propellant management system. The point sensors and capacitance probe 
provides FO/FS redundancy in the propellant tanks for propellant loading. 

The control and measurement circuits for each capacitance probe are 
simplex single paths with backup capability provided by discrete measurements 
from the point sensors. The control and measurement circuits for the point 
sensors are duplex. 

After liftoff, the capacitance probes and level sensors in the main 
propellant tanks are used for information only and are not required for flight 
operations. After main engine cutoff, the power to these systems is 
terminated. 

The APS propellant level monitoring system will remain active through- 
out the entire mission. However, the system is not expected to yield usable 
information during periods of zero g. 

The propellant depletion sensors are quad redundant in each tank, and 
two out of four must signal depletion before an engine cutoff will be com- 
manded by the DCM system. The sensors for each tank will be operating at 
liftoff, but the computer will be programmed to ignore them until a pre- 
determined point in the boost phase (for main engines) and the OMS burn 
periods (for OMS engines). 
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The main engine LH 2 depletion cutoff system is a backup for velocity 
cutoff, and four sensors are used in each tank to achieve .FO/FS redundancy 
even though it is a backup system. 

Redundancy. Redundancy management, will be limited to switching 
power and response monitoring between two alternate paths through two ACT 
units for the hot-wire sensors only. No management switching is required 
for the simplex capacitance level sensing circuits. The DCM system will 
activate the hot-wire sensors from a primary bus and monitor the system 
through alternate ACT units. A failure of the primary bus system will cause 
the DCM system to activate the secondary source to the sensors. Each 
sensor output will be checked against its corresponding open-circuit indicator 
to determine its validity. 

Separation Electrical Controls 

The separation electrical controls (SEC) consist of the electrical con- 
trol circuitry and electrical components which are required to initiate 
ordnance devices which will separate the ESS from its payload. The system 
will be sequenced by an automatic computer located onboard the ESS vehicle. 
The ESS/booster separation sequence is controlled by the booster and is 
discussed in Volume II, Book 3 of this report. 

Requirements . The requirements are as follows: 

1. There must be a separation plane between the ESS vehicle and the 
payload. 

2. The ESS must provide the electrical control for the ESS/payload 
separation system. 

3. The system must utilize the exploding bridgewire (EBW) technique. 

4. Where design options exist, the selected configuration will be the 
most cost effective. 

5. The separation system must be designed in such a way that a 
single failure will not prevent the SEC from initiating the separa- 
tion of the payload. 

6. All separation system control functions must be designed to be 
supplied from within the ESS. 

7. The ESS computer via the data bus and ACT units must be utilized 
to provide separation command, timing, and sequencing. 
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The ESS/payload separation system must be designed to allow 
rapid checkout of the system with an- automatic computer controlled 
program. 

9. Pulse sensors will be used to provide EBW firing unit checkout. 

System Description. The ESS electrical control for the ESS/payload 
separation system is shown in Figure 2-177. Redundant data buses will 
provide computer control and monitoring to redundant ACT units. ESS/ 
payload separation will be accomplished by the computer addressing ACT 
unit A to select the output channel connected to the control input of PCS 1 
(power control Switch 1). The PCS control input will require a nominal 
+5 vdc discrete input at 10 milliamperes of current. The output of PCS 1 
will now switch to a nominal +28 vdc and provide the charging voltage for 
arming ESS/payload separation firing unit 1. The +28 vdc output of PCS 1 
will be monitored by ACT unit D. The +28 vdc output of PCS 1 is protected 
against a short circuit to ground by an internal circuit which automatically 
removes the +28 vdc output. PCS 1 also contains a +5 vdc short-circuit trip 
indication output that operates when the +28 vdc output is shorted to ground. 
PCS 1 can be reset by removing the control input signal from ACT A when 
the short has been removed. 

ACT B can also be addressed by the computer to select the output 
channel connected to the input of PCS 2. In this case, the output of PCS 1 
will also provide the charging voltage for arming the ESS/payload separation 
firing unit 1. The input power for PCS 2 is obtained from a different power 
source than that for PCS 1. Each firing unit is provided with redundant 
power sources for the arming and triggering signals. The ESS/payload 
firing unit 1 will be armed within 1, 5 seconds. The trigger signal can now 
be sent which will discharge the firing unit and initiate the ordnance which 
is necessary for separating the ESS from the payload. The trigger signal to 
the firing unit 1 is originated by a computer address to ACT unit A. The 
output channel of ACT A, which is connected to PCS 3, is activated by the 
computer address to the ACT unit. The output of PCS 3 will now switch to 
a nominal +28 vdc which will provide the trigger signal to ESS/payload 
separation firing unit 1. It is assumed that the solid-state circuitry in PCS 3 
will require two 'failures to inadvertently arm an EBW firing unit, but it 
would still take another two failures in another solid state switch to 
advertently trigger an EBW firing unit. A redundant trigger signal to ESS/ 
payload separation firing unit 1 can also be provided by a computer address 
to ACT B which selects the output channel connected to the input of PCS 4. 

In this case, the +28 vdc output of PCS 4- will provide the trigger signal 
necessary for triggering ESS/payload firing unit 1. ESS/payload pulse 
sensor 1 will be used to ground check’the EBW firing 1 for the pulse- that is 
necessary to initiate the separation ordnance. The pulse sensor will be 
replaced before flight by an ordnance device. During ground checkout, the 
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pulse sensors will be controlled by the computer. As shown in Figure 2-177, 
the computer will address ACT B to command PCS 5 to switch +28 vdc to the 
power and input connections of ESS/payload pulse sensor 1. The output of 
the pulse sensor will switch on +28 vdc when the EBW firing unit is triggered. 
An analog output voltage (0 to 5 vdc) of the EBW firing unit, representing the 
voltage charge on its capacitor, will be monitored by ACT unit D for the 
correct value. The +28 vdc output of the pulse sensor will be removed by a 
reset signal to the pulse sensor. The pulse sensor can be self-checked with- 
out triggering the EBW firing unit with a computer address to ACT B and 
PCS 6. ACT unit D will monitor the solid state power controller outputs and 
provide the computer with this information. The information can be used 
for fault isolation when a failure occurs during normal separation system 
operation. This will also provide the capability to determine a failed 
component when the computer addresses an ACT unit and no response is 
indicated by the monitoring ACT unit. The remaining circuitry shown in 
Figure 2-177 for firing unit 2 and pulse sensor No. 2 will operate the same 
as previously described for firing unit 1 and pulse sensor 1. The separation 
system contains two completely redundant and independent systems. 

Redundancy. The redundancy provisions are as follows: 


1. Power . Three redundant main power sources of +28 vdc will be 
utilized for powering the ACT units, power control switches, and 
EBW firing units, as shown in Figure 2-177, to accomplish ESS/ 
payload separation. 

2. Component . Redundant power control switches will be utilized in 
controlling the arm and trigger signals to each EBW firing unit. 
Redundant ACT units will be used to provide computer control (via 
the data bus) of each EBW firing unit. 

3. Failure Mode Effects Analysis. Redundant EBW firing units are 
used to initiate the explosive ordnance required for ESS/payload 
separation. As shown in Figure 2-177, there are redundant data 
buses to be used by the computer in addressing redundant ACT 
units. Redundant ACT units are also used for monitoring. 
Inadvertent separation is prevented by using individual solid-state 
switches for arming and triggering each EBW firing unit. Two 
failures would have to occur in one solid-stage power control 
switch (PCS) to inadvertently provide a +28 vdc output in the 
absence of an input signal. It would require four solid-state 
switch failures to inadvertently separate the ESS from the payload. 
Completely redundant separation circuitry includes a backup mode 
which is inherent in the system design. 
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Figure 2-177. Separation Electrical Controls 
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Management Requirements . Separate and redundant separation 
circuitry is arranged to allow rapid computer control for ascer- 
taining response to a command and to facilitate rapid fault isolation 
in the case of no response. The output of each power controller 
switch is monitored and may be used to determine the response to 
a computer command Commanding and monitoring other ACT 
unit output channels will provide isolation to a completely failed 
ACT unit or an individual output channel. Adequate control and 
monitoring functions are provided to rapidly isolate a fault to an 
individual component. 

5. Permissivities . Require program instructions to require ESS/ 
booster separation complete and orbit insertion assured to enable 
the ESS /payload separation arming command. 

Safing Electrical Control Subsystem 

The safing electrical controls subsystem consists of those items 
required to operate together to effect the opening of the ESS main propellant 
tanks to allow boiloff of residual propellants. The vehicle must be safed 
from propellant and pressurant overpressures. All safing functions must be 
designed to vent pressure vessels with pressure greater than 50 percent of 
burst to less than 25 percent of design burst pressure. The safing system 
will safe the main propellant tanks in a nonpropuls ive manner to prevent 
ESS /payload recontact after separation and to assure that the ESS vehicle 
will not break up in orbit and endanger the payload. 

Requi r ements . The requirements are as follows: 

1. Safing component single failures must not affect the flight system 
during prelaunch or flight. 

2. Where failure to safe a tank could result in overpressure and 
possible rupture, redundant means of safing must be used. 
Redundancy may be in the form of a simplex electrical control 
circuit with a backup mechanical relief. 

3. Where design options exist, the selected configuration will be the 
most cost effective. 

4. Safing systems will fail operational; that is, all single-point 
failures shall be eliminated by redundancy. 

5. All safing electrical control functions will be designed to be 
supplied from within the ESS stage. 
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The ESS computer via the data bus and ACT units will be utilized 
to provide safing commands, timing, and sequencing. 

7. Physical separation of the ESS stage from the payload shall not be 
required to initiate the safing functions. 

8. The ESS safing system shall be designed to allow rapid checkout 
of the system with an automatic computer-controlled program. 

9. Pulse sensors will be used to provide EBW firing unit checkout. 

System Description. This safing subsystem may be described as 
follows: The ESS vehicle main propellant tanks will be safed approximately 

5 seconds after main engine cutoff unless safing is delayed to allow the main 
tank propellants to be used as ballast. The main LOg and LH 2 tanks are the 
only ESS vessels requiring safing. Figures 2-178 and 2-179 are schematic 
block diagrams of the redundant LO^ and LHg tank safing system. 

Redundant data buses will provide computer control and monitoring to 
the redundant ACT units, as shown in Figure 2-178, for the LOg tank safing 
system. LOg tank safing will be accomplished by the computer addressing 
ACT unit A to select the output channel connected to the control input of 
PCS 1 (power control switch). The PCS control input will require a nominal 
+5 vdc discrete input at 10 milliamperes of current. The output of PCS 1 will 
now switch to a nominal +28 vdc and will provide the charging voltage that 
arms the LOg tank EBW firing unit 1. The +28 vdc output of PCS 1 will be 
monitored by ACT unit B. The +28 vdc output of PCS 1 is protected against 
a short circuit to ground by an internal circuit that will automatically 
remove the +28 vdc output. PCS 1 contains a +5 vdc short-circuit trip 
indication output that operates when the +28 vdc output is shorted to ground. 
PCS 1 can be reset by removing the control input signal from ACT A when 
the short has been removed. ACT A may also be addressed by the computer 
to select the output channel connected to the input of PCS 6. In this case, 
the output of PCS 6 will also provide the +28 vdc charging voltage necessary 
to arm the LOg tank EBW firing unit 1. The input power for PCS 6 is 
provided by a separate power source. Each firing unit is provided with 
redundant arming and triggering signals which originate from separate 
power sources. 

The LOg tank EBW firing unit 1 will be armed in 1. 5 seconds and 
is ready to be triggered and, in turn, to initiate the ordnance that will open 
the LOg tank valve to safe the tank. The trigger signal to the LOg tank EBW 
firing unit 1 is originated by a computer address to ACT unit A. The output 
channel of ACT A, which is connected to the control input of PCS 2, is 
activated by the computer address to the ACT unit. The output of PCS 2 
will not switch to a nominal +28 vdc which will provide the trigger signal to 
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Figure 2-178. Safing Electrical Controls (Main LO 2 Tank) 
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Figure 2-179. Safing Electrical Control (Main LI-12 Tank) 
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the L iOz tank EBW firing unit 1. It is assumed that the solid-state circuitry 
contained within PCS 2 will require two failures to inadvertently produce a 
+28 vdc output in the absence of an input signal. The arm input would require 
two failures in PCS 1 to inadvertently arm the firing unit and two additional 
failures would be necessary to inadvertently safe the LOg tank. Four solid- 
state switch failures in the same safing system would be neces.sary to 
inadvertently safe a tank. 

A redundant trigger signal to LOg tank EBW firing unit 1 may also be 
provided by a computer address to ACT A which selects the output' channel 
connected to the input of PCS 7. In this case, the +28 vdc output of PCS 7 
will provide the trigger signal necessary for LOg tank EBW firing unit 1. 

LOg tank pulse sensor 1 will be used to ground check the EBW firing 
unit 1 for the correct charge value that will be required to initiate the 
ordnance chain for opening the safing valves. The pulse sensor will be 
replaced before launch by the detonator. During ground checkout, the pulse 
sensors will be controlled by the computer. Referring to Figure 2-177, the 
computer will address ACT A to command PCS 5 to switch +28 vdc to the 
power input of LOg tank pulse sensor 1. The output of the pulse sensor will 
switch to +28 vdc when the EBW firing unit is triggered. An analog output 
voltage (0 to 5 vdc) of the EBW firing unit, representing the charge on the 
capacitor, will be monitored by ACT unit B for the correct value. The 
+28 vdc output of the pulse sensor will be removed by a reset signal to the 
pulse sensor. The computer will reset the pulse sensor by addressing ACT 
unit A and controlling PCS 3 to switch the reset signal to the pulse sensor. 

The pulse sensor may be self-checked without triggering the EBW firing unit 
via a computer address to ACT A and PCS 4. 

ACT unit B will monitor the solid-stage power controller outputs and 
provide the. computer with this data. The data can be used for fault isolation 
when a failure occurs during normal safing system operation. This will 
also provide the capability to determine a failed component when the computer 
addresses an ACT unit and there is no response indicated by the monitoring 
ACT unit. 


The remaining safing control system circuitry in Figures 2-178 and 
2-180 will be identical and will operate the same as described previously 
for Figure 2-179* These two schematic block diagrams represent two 
redundant and independent safing systems for each of the main propellant 
tanks which are powered from three redundant and separate sources. 

Components . The components required to mechanize the electrical 
control of the safing system, as defined in Paragraph 3. 2. 5, .are the EBW 
pulse sensor, firing unit and the solid-state power controller switch which are 
detailed in Paragraph 2. 3. 5 under Separation Electrical Controls. 
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Redundancy. The redundancy provisions are as follows: 

1. Power. Three redundant main power sources of +28 vdc will be 
utilized for powering the ACT units, power control switches, and 
EBW firing units in Figures 2-178 and 2-179 to accomplish LOg 
and LHg tank safing. 

2. Component . Redundant power control switches will be utilized in 
controlling the arm and trigger signals to each EBW firing unit 
and pulse sensors. Redundant ACT units will be used to provide 
computer control (via the data bus) of each EBW firing unit and 
pulse sensor. Redundant ACT units will be used to provide 
monitoring of the power control switches, EBW firing units, and 
pulse sensors. 

3. Failu re Mode Effects Analysis . Redundant EBW firing units and 
associated ordnance train will be used to safe each main tank. 

As shown in each figure, there are redundant data buses to be used 
by the computer in addressing redundant ACT units. Redundant 
ACT units are also used for monitoring. Figure 2-178 contains 
redundant circuitry for safing of the LOg tank. Figure 2-179 
contains redundant circuitry for safing of the LHg tank. Inadvertent 
safing of a tank is prevented by using individual solid- stage switches 
to arm and trigger each EBW firing unit. Two failures are neces- 
sary in one solid-stage power controller switch (PCS) to inadver- 
tently provide a +28 vdc output in the absence of an input signal. 

It would require four solid-state failures in Figure 2-178 or 
Figure 2-179 to inadvertently safe the LOg or LHg tank. 

4. Management Requirements . Separate and redundant safing cir- 
cuitry for each of the main propellant tanks is arranged to allow 
rapid computer control for ascertaining response to a command 
and to facilitate rapid fault isolation in the case of no respohse. 

The output of each power controller switch is monitored and may 
be used to determine response to a computer command. Com- 
manding and monitoring other ACT unit output channels will provide 
isolation to a completely failed ACT unit or an individual output 
channel. Adequate control and monitoring functions are provided 
to rapidly isolate a fault to an individual component. 

5. Backup Modes . Completely' redundant safing circuitry for each of 
the main propellant tanks include a backup mode which is inherent 
in the system design. 
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Thrust Vector Electrical Controls 



There are four independent thrust vector electrical control (TVEC) 
elements. The differences between the elements for the main propulsion 
engines and the orbital maneuvering system (OMS) are primarily in their 
load handling capacities rather than' in basic operation. Therefore, the MPS 
engine actuation subsystem will be discussed with only important differences 
from the OMS actuation system indicated. 

The TVEC provides hydraulic power for the orbiter engine nozzle 
extender- retractor mechanism and for the eight engine -gimbaling servo- 
actuators. The orbiter engine accumulator reservoir manifold assembly 
(ARMA) will be pressurized before launch to allow the engines to be positioned 
prior to engine start. The OMS engine ARMA does not require prelaunch 
prepressurization. The OMS actuation system will be activated before per- 
forming orbital eccentricity changes, before orbital altitude changes, and 
before the deorbiting during the earth- orbiting period to keep fluid sufficiently 
warm to support OMS gimbaling requirements. (See Figures 2-180 and 
2-181 for block diagrams of the OMS and orbiter engine controls.) 

Requirements . The actuation system will be designed to meet the 
FO/FS criteria. A switching system will be provided to permit operation of 
the electric motors from either a ground power or airborne power source. 

All solenoid valve operations will be under direct computer control. Con- 
trolled application of power to the OMS hydraulic pumps during the earth- 
orbiting period will be as a function of hydraulic fluid temperature. 

System Description . The operation of the TVEC is similar to that of 
the engine actuation system on the Saturn S-II vehicle in that hydraulic power 
for in-flight actuation is provided by a hydraulic pump on the engine and 
requires an auxiliary system for ground operation. The main differences 
are the MPS engine. .nozzle extension- retraction requirement, the OMS 
electric motor operation requirement, and the redundancy requirements. 

Power Transfer Switches. These switches permit the application and 
removal of either ground -supplied or vehicle-supplied three-phase, 400-Hz 
power. The ground- supplied source is applied through a motorized transfer 
switch controlled by computer command. The vehicle source is applied 
through a system of transfer switches which provide the necessary redundancy. 
Each pair of in-line switches is controlled by a single computer command. 

The input power is applied in such a way that no set of two failures can 
disable both hydraulic systems, thereby allowing no less than one engine per 
pair to remain under control. 
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Electric Motor/Hydraulic Pump. The motor converts the applied 
electrical power into the mechanical torque necessary to satisfy the demands 
of the hydraulic pump. The larger the demand, the greater the torque and 
the larger the input electrical power requirement. The hydraulic pump is a 
variable delivery, variable displacement, pressure-compensated type. 

It is designed to provide a minimum pressure at any flow demanded by the 
hydraulic load. 

Solenoid Valves. Solenoid valves allow the computer to control the 
flow of hydraulic fluid. The valves shown on the outputs of the hydraulic 
pumps are for reducing the start-up torques on the engine turbines. 
Decreasing the engine turbine load decreases the probability of engine stall- 
out during the ignition sequence. It may be necessary to utilize a check valve 
and operate the electric motor /hydraulic pump before engine ignition. This 
would reduce the short-duration engine turbine start-up torque which would 
be present with an unpressurized actuation system. A system configuration 
which is still being considered is the placement of the electric motor on the 
engine turbine hydraulic pump. This configuration could aid engine ignition 
by prespinning the engine turbine. 

Accumulator Reservoir Manifold As sembly (ARMA). The ARMA 
consists of an accumulator which stores hydraulic power, supplements 
hydraulic pump flow during peak system demands, and dampens pump dis- 
charge pulsations during peak system surges; a reservoir which pressurizes 
the pump inlet, stores system hydraulic fluid, and receives system return 
flow; normally open lock-up solenoid valves which close the inlet and outlet 
ports to the accumulator, thereby storing hydraulic power; filters, a 
thermal switch, a nitrogen-charging valve, and instrumentation transducers. 

The ARMA is pressurized with nitrogen (orbiter engines) before liftoff, 
and the lockup solenoids are energized (valves closed). Some time before 
engine ignition, the lock-up solenoids are deenergized. Hydraulic power 
thus becomes available for positioning the engines before ignition, permitting 
smooth transition into the powered phase of flight. 

The OMS engine ARMA does not require lock-up solenoid control since 
the hydraulic pumps must pressurize the entire hydraulic system before 
engine ignition. These two hydraulic systems, however, employ temperature 
monitoring of the hydraulic fluid for purposes of controlling its intermittent 
circulation and preventing excessively high or low temperatures. Operation 
of the pumps will commence whenever any two of the four sensors reach a 
low-temperature limit or when one sensor reaches an under low- 
temperature limit and no other sensor indicates a high-temperature limit. 
Pump operation will cease when any sensor indicates a high-temperature 
limit and no other sensor indicates a low-temperature limit. In the event 
that either sensor of one system indicates the low-temperature limit while 
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the other system indicates at least one high-temperature limit, the hydraulic 
fluid will be circulated only on the one system. The sensors will fail in. a 
normal temperature-indicating mode (see Performance Analysis). 

Servoactuators. The swiveling or gimbaling of the four engines (two 
OMS and two Main) is accomplished by four pairs of servoactuators. Each 
pair is connected between the vehicle structure and each engine so that one 
servoactuator line of action is perpendicular to the other. 

The servoactuators on each engine respond to separate commands from 
the flight control system to gimbal an engine in pitch or yaw. Appropriate 
gimbaling of the two MPS engines will produce roll control. The OMS 
engine s ervocactuato rs will be supplemented by the attitude control propulsion 
system (ACPS) for roll control. In the event that one orbiter engine is 
disabled, the ACPS will provide backup roll control. There is a separate 
actuation system for each working pair of servoactuators and the rupture of 
one hydraulic system cannot disable another. 

Performance Analysis. The source of ac power and the power transfer 
switches will be capable of handling the peak current surges that are required 
by the electric motors during startup. The ARMA lockup solenoid valves 
(MPS engine hydraulic system) are energized after the storing of hydraulic 
power in the two accumulators. 

Although the energy to activate the ARMA solenoid valves is supplied 
by three separate ACT units, only one need be addressed at a time. The 
accumulator hydraulic oil pressure may be used as a final indication that the 
equipment is operating normally. Operation of the solenoid valves by the 
secondary or tertiary ACT units is necessary if intermediate failures are 
detected. Solenoid valves are normally closed in the deenergized state. 

As with the solenoid valve activation, application of power to the 
electric motors may be accomplished by addressing only the primary ACT 
unit. Monitoring the change in inverter input current will determine the 
need for addressing secondary or tertiary ACT units. Failure to apply power 
to an electric motor after three such attempt will caus'e application of power 
from a separate inverter. This method satisfies FO/FS requirements in 
that gimbaling of one engine is still possible after sustaining two in-line 
power transfer switch failures. 

The redundancy scheme is designed so that it can sustain two failures 
without completely disabling the vehicle. The worst case would permit 
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operation of at least three of the four main engine and OMS hydraulic 
systems. The following operations are typical of a main engine hydraulic 
actuation system. 

1. Apply 400 Hz power to auxiliary motor 1. 

a. Failure: No output command from the first ACT unit. 

Solution: Issue command from the second ACT unit. 

b. Failure: No output command from the second ACT unit. 

Solution: Issue command from the third ACT unit. 

c. Failure: No output command from the third ACT unit. 

Solution: Exit program- to predetermined decision point A. 

d. Failure: Command first power transfer switch (PTS) ON - 

no first inverter current. 

Solution: Remove first PTS ON command - apply second PTS 

ON command. 

e. Failure: No second inverter input current. 

Solution: Exit program to predetermined decision point A. 

f. Failure: Excessive first inverter input current. 

Solution: Remove first PTS ON command - apply second PTS 

ON command. 

g. Failure: Excessive second inverter input current. 

Solution: Remove second PTS ON command - exit program to 

predetermined decision point A, 

2. Energize hydraulic pump unloading solenoid valve. 

a. Failure: No unloading solenoid valve discrete feedback. 

Solution: As in Items la, lb, and lc, exit program to pre- 

determined decision point B. 


2-432 


SD 71-140-2 



o 

3. Deenergize ARMA lockup solenoid (assume accumulator is 
charged). 

a. Failure: Lockup solenoid will not deenergize - no servo- 

actuator hydraulic power. 

Solution: Issue first ACT unit discrete profile through second 

ACT unit, then disable (remove power from) first 
ACT unit. Deenergize ARMA lockup solenoid 
through second ACT unit. 

b. Failure: Lockup solenoid will not deenergize - no servo- 

actuator hydraulic power. 

Solution: Issue second ACT unit discrete profile through third 

ACT unit, then disable second ACT unit. Deenergize 
ARMA lockup solenoid through third ACT unit. 

c. Failure: Lockup solenoid will not deenergize - no servo- 

actuator hydraulic power. 

Solution: Exit program to predetermined decision point C. 

Decision points are as follows: 

A. Failure to provide hydraulic power for nozzle extension before 
engine ignition will prevent the nozzles from being extended. 

Ignition of the engines in this mode will result in lower thrust 
levels and consequent modification of mission goals. Hydraulic 
power initially stored in the ARMA units will still be available 
for pre-ignition engine gimbaling. 

B. Inability to activate the unloading solenoid valve would prevent 
bypassing the high-pressure to low-pressure hydraulic lines 
during engine start. The result would be a much greater torque 
working against the spinup of the engine turbine during the engine 
start sequence. The added load will reduce the probability of 
obtaining engine ignition. Energizing of the solenoid, however, 
should be accomplished before launch; therefore, it does not 
constitute an in-flight abort mode under these circumstances.. If 
it deenergized after launch but before engine start and could not be 
reenergized, the engine start command would be issued 
nonetheles s. 
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C. The probability of the solenoid lockup valves remaining closed 
after removal of the closing command is extremely small. If it 
did occur, however, the engine start command is still expected to 
be given, and the burden of providing hydraulic oil pressure would 
fall on the auxiliary motor hydraulic pump and, as the engine 
thrust builds up {hence, hydraulic pressure), on the engine turbine 
hydraulic pump. Vehicle disturbing transients would be expected 
during this period. Circulation of the hydraulic fluid in the OMS 
hydraulic system is controlled by the fluid temperature. Since 
there are four temperature sensors - two on each engine actuation 
system - turning the electric motors on or off is based on the 
temperatures sensed by these four sensors. Table 2-35 illustrates 
the operating limits and bands of the hydraulic fluid. 

Motor 1 (Ml) - associated with sensors a and b; Motor 2 (M2) - 
associated with sensors c and d. Operation will be in accordance 
with the following: 

(1) Ml and M2 ON - any two sensors below LL or one sensor 
below UT while no sensor is above HL. 

(2) Ml ON, M2 OFF - Sensors a and b below LL, sensor c or d 
above HL. 

(3) Ml OFF, M2 ON - Sensor a or b above HL, sensor c or d 
below LL. 

(4) Ml OFF, M2 OFF - any sensor above HL while no sensors 
are below LL. 

This constitutes a FO/FS system. 

2. 3. 6 instrumentation 


The ESS instrumentation subsystem consists of data sensors, signal 
conditioners, and measurement remote calibration. Instrumentation will 
assign the locations of the data sensor signal conditioning, the design 
philosophy being, where feasible, the signal conditioning equipment will be 
located with or adjacent to the sensor. Due to the temperature environment, 
some equipment has to be located in thermally controlled areas. Instru- 
mentation will also control the types of data sensors on the ESS vehicle and 
in the ground support equipment to assure commonality and compatibility with 
the signal conditioning, calibration, and the recording equipment. 
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Table 2-35. Hydraulic Fluid Operating Limits 


Over-temperature band 


High-temperature band 


Normal operating 
temperature band 


Low-temperature band 


Under - temperature band 


OT (over -temperature limits) 

HL (high-temperature limit) 

N 

LL (low-temperature limit) 
UT (under -temperature limit) 


Note : 

N - Normal operating temperature band. 

HL - High-temperature limit of the hydraulic fluid. 

LL - Low-temperature limit of the hydraulic fluid. 

OT - Over -temperature limit above which the hydraulic fluid 
will begin to sustain heat damage. 

UT - Under -temperature limit below which the hydraulic fluid 
will begin to solidify (bi-phase or slush state). 


Instrumentation Requirements 

The instrumentation system must provide a means of obtaining 
information on the ESS to assure that an accurate performance evaluation of 
each vehicle subsystem can be made during ground checkout and/or flight. 

To determine the criticality of the measurement or measurement hard- 
ware with consideration given to cost, weight, and the importance of the 
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measurement if lost during checkout or flight, four categories of 
instrumentation requirements are established: 

1. Measurements critical to the operation of the vehicle systems or 
subsystems 

2. Component performance and system performance verification 

3. Environmental verification 

4. Data to assist in isolating system or component malfunction 

Only those measurements considered critical to the operation of the vehicle 
and/or safety of the crew will be redundant. 

The instrumentation system does not include discrete -types of meas- 
urements or any type of engine measurements. The engine measurements 
and their associated signal conditioning will be the engine contractor's 
responsibility. Discrete-type measurements require no signal conditioning 
and interface directly with the DCM subsystem for monitoring. One listing 
of instrumentation measurements will be maintained. The ESS signal list 
will include discretes and all engine measurements. The ESS measurement 
requirements listed by the measurement type, quantity, and subsystem, 
excluding the engine measurements, are listed in Table 2-36. 

Instrumentation Subsystem Description 

Sensors . The technology gained from the Saturn S-II Program and the 
transducers, signal conditioning state-of-the-art studies conducted for 
INT-21 launch vehicle, and the study performed by the British aircraft 
corporation for the shuttle vehicle have made it possible to choose the type 
of transducers best qualified for all types of measurement requirements 
without a trade study or transducer development program. 

This study has not addressed itself to a detailed measurement list, 
but to the type of measurement requirements and to the type of sensors .and 
signal conditioning equipment that would be utilized for the ESS instrumen- 
tation system. Table 2-37 is a listing of the measurement types and hardware. 

Signal Conditioning. All ESS analog measurements will require some 
form of signal conditioning. The signal conditioning equipment can be 
mounted either with the sensor or in temperature-controlled areas. 

, Due to the high-level input voltage requirements of the communication 
systems ACT unit, digital signal conditioning is to be adopted. Compared to 
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Table 2-36. ESS Measurement Requirements 


ro 

i 

OJ 

-j 


System 

Acoustic 

Temperature 

Pressure 

Vibration 

Flow 

Position 

Discrete 

Liquid 

Level 

Voitage/Curronl 
Power /F requency 

Speed 

Si rain 

Total 

Propellant feed 


16 

17 




160 





m 

Attitude propulsion 


56 

74 


4 

6 

318 

2 


4 


464 

Pressurization 


6 

12 




38 





106 

Propellant management 


50 





193 

10 

6 



259 

Insulation 


20 

4 

6 








30 

Thermal control 


24 

4 


2 







30 

Instrumentation 


10 







16 



26 

Aerodynamics 

8 

15 

6 ' 

40 







20 

89 

Communication 


2 





70 


12 



84 

Engine actuation 


8 

20 



8 

26 

4 




66 

Data control management 


12 







\z 



24 

GN&C 


6 


9 





508 



56 J 

Total 

8 

2Z5 

TIT 

55 


14 

855 

16 

554 

4 

20 

T93T 


Note Integration of GNfcC, the shuttle APS, and redundancy management requirements Jtae provided a largo number of measurements; 

however, the data hus approach has sufficient capacity to handle 2440 measurements, ' , 
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Table 2-37, ESS Transducer and Signal Conditioning Requirements 


MEASUREMENT 

TYPE 

TRANSDUCER 

TYPE 

SIGNAL CONDITIONING TYPE 

ACCELERATION 

FORCE MASS 

DIRECT 

VIBRATION 

PIEZOELECTRIC 

CHARGE AMPLIFIER 

TEMPERATURE 

THERMOCOUPLE 

REFERENCE JUNCTION - DIGITAL RAT IOMETER - D/A CONVT 

TEMPERATURE 

PLATINUM RESISTANCE 

BRIDGE - DIG ITAL RAT IOMETER - D/A CONVERTER 

PRESSURE &AP 

STRAIN GAUGE 

DIGITAL RATIOMETER - D/A CONVERTER 

.SPEED 

MAGNETIC 

FREQUENCY TO DIG ITAL CONVERTER - D/A CONVERTER 

FLOW 

IMPELLER -MAGNETIC 

FREQUENCY TO DIG ITAL CONVERTER - D/A CONVERTER 

POSITION 

POTENTIOMETER 

DIRECT 

POSITION 

DIFFERENTIAL XFORMER 

DIRECT 

VOLTAGE/CURRENT 


DIRECT OR OFFSET FOR HIGH RESOLUTION 
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the conventional method of utilizing an analog dc amplifier, miniature-sized 
transducer analog -to -digital converters signal conditions are selected. This 
method has many advantages, such as higher precision and accuracy, higher 
reliability, less electrical noise in transmis sion, less weight, less cost, 
and less power consumption. 

The transducer analog -to -digital conditioner will accept and change 
low-level analog signals from transducers into ten-bit output signals, without 
the need for a highly stable power supply. It will contain an internal 
electronic switch to provide for shunt calibrations and another for pulsed 
operation of the transducer bridge which causes it to operate as a radiometer. 
Figure 2-182 shows a typical measurement block diagram utilizing digital 
signal conditioning. 

Measurement Remote Calibration. To assure confidence in the meas- 
urement of a parameter, the constituent parts of the measurement must be 
checked for accuracy and for possible fault operation. 

Two calibration systems are proposed: one will be part of the ESS 
vehicle instrumentation system for calibration and operation verification of 
selected measurements such as red-line and critical systems performance; 
the second calibration system proposed will be a removable plug-in unit to 
be utilized to checkout and verify all instrumentation measurements before 
their use in obtaining vehicle subsystems data. 

Both calibration systems will be designed to verify the measurements 
accuracy by verification of: (1) sensor, (2) signal conditioning electronics, 
and (3) the output of the signal conditioning. In addition, the above three 
point systems verification will assist in locating or isolating the cause of 
a faulty measurement. The data and control management computer will 
command the communications ACT unit that will activate the self-check or 
calibration verification routine of both vehicle or ground checkout 
calibration systems. 

Vibration Measurements . Digital signal conditioning is not superior 
for all measurements and applications. Figure 2-183 represents the proposed 
vibration measurement utilizing a piezoelectric pickup and an analog type 
charge amplifier for signal conditioning. The ESS vibration measurements 
do not interface with the vehicle data bus but are routed to the communication 
systems CBW FM telemeter system. Utilizing a vibration multiplexer, a 
maximum of 100 vibration measurements can be transmitted. The vibration 
system can be removed from the ESS vehicle, if desired, without major 
instrumentation or communication systems redesign. 
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Figure 2-182. Typical Digital Signal Conditioned Measurement 
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Figure 2-183. Typical Vibration Measurement 
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2. 3. 7 Avionics Equipment Installation and Environmental Control 

The objective of this'section is to describe the preliminary installation 
design of avionics equipment on the ESS vehicle. This equipment must be 
installed in a manner that will assure its designed operating performance 
during all phases of the 24-hour ESS mission. This task includes: the 
preliminary design of equipment containers, equipment thermal and vibration 
isolation, passive thermal insulation, and active environmental control. It 
will also cover the installation of equipment in the containers and the installa- 
tion of the containers on the ESS. 

The study approach is as-follows: 

1. Define equipment characteristics by weight, volume, installation 
and environmental operational limits. 

2. Establish predicted environment imposed upon the astrionic 
equipment during the total 24-hour mission. 

3. Define optimum astrionic equipment areas on the ESS vehicle 
which will assure that the equipment will operate within its designed 
envelope to fulfill the ESS mission objectives. 

4. Establish the preliminary design of the avionics equipment con- 
tainers, equipment installation within the container, container 
installation on the stage, and installation of special electronic 
equipment as required to support the '24-hour mission objectives. 

5. Determine the thermal control requirements and associated 
hardware. 

Requirements 

To establish the installation design of avionics equipment on the ESS 
vehicle requires a knowledge of the thermal and dynamic environment on the 
stage during the 24-hour missions. The thermal and dynamics characteristics 
of the equipment to be installed must also be defined. The design require- 
ments were established using the following ground rules and assumptions: 

1. Space station payload. 

2. Maximum ESS lifetime is 24 hours. 

3. The vehicle attitude is Y-POP (Y axis perpendicular to the orbital 
plane) nose forward before turn-around. 
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4. Turnaround will occur just before deorbit retro burn. 

5. The vehicle orbits are 100 and 270 nautical miles at an inclination 
of 55 degrees to the equator. 

6. Maximum use of S-II equipment container design. 

7. Maximum use of information gained from previous S-II derivative 
studies. 

8. The aft skirt area will be closed out. 

9. High value, aft skirt mounted, avionics equipment will be designed 
for recovery. 

Thermal Environment . The thermal environment considerations are 
those associated with ground operations, boost, and on-orbit operations. 

1. The ground temperatures will be similar to those on the present 
S-H stage in the mated and tanked configuration; therefore, a dry 
nitrogen purge system, will be required to maintain thermal control 
and to deactivate inert avionics equipment during ground operations 
before launch. 

2. Temperatures on the stage during the boost phase are shown in 
Figures 2-47 and 2-51. A review of the figures indicates that the 
external surface of the thrust structure is adequate for mounting 
avionics equipment containers; however, locating containers in the 
forward and aft skirt in the Position IV quadrant should be avoided 
due to high aerodynamic heating. 

3. The thermal environmental difference between the shuttle orbiter 
and the ESS is that the shuttle orbiter is subjected to the high heat 
loads imposed on the vehicle during reentry. These high heat loads 
present a pacing design requirement for the orbiter avionics 
equipment thermal control system. This requirement is not 
applicable to ESS. The orbital thermal environment is the most 
critical from an avionics equipment installation standpoint on the 
ESS. This is due to the fact that the ESS will be exposed to the 
orbital environment for approximately 23 1/2 hours of the total 
24-hour mission. 

Dynamic Environment . The dynamic environment to which the ESS 
will be subjected consists of mechanical vibration and acoustics; this is a 
result of shuttle booster launch, max Q, and critical aerodynamic attitudes. 
The only predicted dynamic environment available for this publication is that 
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associated with .lift-off which may not be the most severe; however, only 
the lift-off environment will be considered at this time for the dynamic design 
requirements . 

1. The predicted random and sine vibration levels were obtained using 
the existing S-II structural configuration. The vibration levels on 
the lower aft skirt are anticipated to be high enough to warrant 
vibration isolation of equipment mounted in -this area, but equip- 
ment mounted on the thrust cone may not require vibration isola- 
tion. Equipment mounted in the forward skirt will require vibra- 
tion isolation. 

2. The predicted launch acoustic level in the forward skirt area is 
l6l. 5 db overall. This level-will present a design problem in 
installing antennas, and acoustic isolation may be required for 
other equipment mounted in this area. The predicted acoustic 
level in the aft skirt is 162. 5 db overall which will also present a 
design problem when installing equipment in this area. The thrust 
cone is the most desirable area for installation of avionics 
equipment because the acoustic level will be lower than that of the 
forward or aft skirt. 

Further study is required to determine more exact sound pressure 
levels and acoustic isolation design requirements. 

Avionics Equipment Environmental Characteristics. The avionics 
equipment was reviewed to establish the environmental and special 
installation requirements. 

Table 2-38 lists all identified electronic components comprising the 
ESS avionics systems. The components are identified by subsystem where 
applicable. The table identifies the selected electronic components required 
as to physical characteristics, design, and operational requirements 
together with special instructions for installation and/or environmental 
control. The operational modes as initially defined covered boost, phasing, 
rendezvous, separation, and deorbit. The percentage figures under the 
operational modes show the estimated time the component will be in opera- 
tion. As noted, most of the astrionics systems are required throughout the 
24-hour ESS mission. 

An assessment of the thermal requirements of the identified electronic 
equipment identifies the air-cooled IMU and the batteries as major design 
installation problem areas. Vendor information indicates that the IMU will 
operate in a vacuum with no external cooling air as long as the upper-case 
temperature remains below 104 F. This would indicate that by installing the 
IMU in a cold space environment and maintaining the unit above its lowest 
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Table 2-38. ESS Avionics Equipment 
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design temperature by optimum use of high-performance insulation and 
heaters, the ESS 24-hour mission objectives will be supported. Ground 
operation will be controlled by the ground purge system. 

The batteries will be mounted in insulated containers and installed in a 
cold space environment. Thermostatically controlled heaters will be 
installed in the containers as required to maintain the batteries within their 
operational temperature limits. 

The remaining identified electronic components will be maintained 
within a temperature range of -40 F to +140 F. All avionics equipment 
requiring environmental protection recovery will be mounted within electronic 
containers. Container design will be such that thermostatically controlled 
heaters will maintain the container temperature above -40 F, and space 
cooling will assure that +140 F is not exceeded. 

In reviewing the special installation requirements, it is noted that no 
major problem areas were identified; however, in assessing each component 
requirement, the antennas, IMU's, and rate gyros require hard mounting 
and specific orientation to perform within their design specifications. The 
antennas will be located around the forward skirt perimeter, 90 degrees 
apart as shown on drawing V7-975401, "Avionics Container Installation - 
ESS. " The IMU's will be mounted on a common base in such a way that each 
IMU is within the specified alignment with the others and that the common 
base is installed on the thrust cone in such a way that the IMU axes are 
triaxially matched to the ESS axes. The rate gyros will also be located and 
aligned as required triaxially to the ESS axes. 

The operational mode of each component indicates the percent of time, 
in each phase, that the component will be active to support the ESS mission. 
This time may be either on standby or in operational status. Noted items 
used only for the boost to orbit phase will be deactivated after accomplishing 
their missions. 

Avionics Equipment Installation and Environmental Control Design 

This section describes the preliminary design of avionics equipment 
installations to fulfill the requirements established in Section 2. 3. 7 under 
Requirements. The section is divided into three parts: equipment container 
design, installation of equipment in containers, and installation design of 
equipment containers on the stage. 

Container Design. The equipment container design is essentially that 
of the present S-II modified to accommodate environment control 
requirements. 
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To protect the equipment in the orbital thermal environment, passive 
thermal control consisting of surface coatings and insulations must be 
considered in the container design. 

The selection of surface coatings is dependent upon their usage 
applications. Equipment containers housing high heat producing equipment 
will have internal and external coatings which provide high infrared emittance 
to dissipate this high internal heat by radiating to the cool surfaces of the 
LH£ forward dome and the aft thrust cone. Equipment containers housing 
low heat producing equipment, which are not exposed to direct solar radiation, 
will have the internal surfaces coated with highly reflective coating and the 
exterior surface coated with a low emittance coating for proper thermal 
control. Table 2-39 contains a listing of surface coatings showing solar 
absorptivity (a) and infrared emissivity (e). The table shows that Dow 
Corning (DC92-007) thermal control white can be used for the internal and 
external surface coatings for containers housing high heat producing equip- 
ment located in the forward or aft areas. This coating was selected because 
of its proved application on other space programs, and it is currently 
controlled by NR specification MA0608-018. For forward and aft containers 
housing low heat producing equipment, the internal surfaces will be coated 
with Fuller aluminum silicone paint and the external surfaces will be covered 
with aluminum foil. 

Container Equipment Installation Design. Equipment -will be installed 
in the containers by system to minimize interconnecting wiring between 
containers. Table 2-40 shows the ESS avionics systems listed by equipment 
container. The table also identifies the general areas in which the equipment 
containers will be located on the stage. 

Container Installation Design . The equipment containers will be 
installed on the stage in areas which present the most ideal thermal and 
dynamic environment. Drawing V7-975401, included as Figure 2-184 shows 
the containers installed on the ESS. Due to high temperatures caused by 
aerodynamic heating, no equipment will be located in the areas adjacent to 
stage position IV. To eliminate the need for equipment cooling, all equip- 
ment containers will be located in areas between stage positions II and III, 
and between stage positions III and IV. These areas present the coldest 
environment during on-orbit operation and should provide adequate cooling 
for the high heat producing equipment during the 24-hour mission. No 
equipment containers will be installed on the lower aft skirt due to the 
extreme dynamic environment in this area. Battery containers will be 
installed on the upper portion of the aft skirt in the area between the thrust 
cone and the LOg tank. The environment in this area should be acceptable 
for properly insulated containers hard-mounted to the basic structure. The 
guidance, navigation, and control equipment and the data control and 


2-448 


SD 71-140-2 



SD 71-140-2 


Table 2-3 9. Surface Coatings Considered for Thermal Control Applications 
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INTERNAL TO 

SURFACE ABSORPTIVITY 

EMISSIVITY 
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CONTAINER 

COATINGS 
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( £ ) 

COMMENTS 
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Use for low 

Aluminum Sheet 

16 - .2 

.06 - .10 

Use when C 750 e F 

emittance 

emittance or 

Aluminum Foil (nystik 7402) 

12 

.04 


requirements 

low absorptance 

Beryllium 

11 - .50 

.10 


(Do not use 

requirements 

Inconel Foil 

32 - .38 

.11 - .13 


when exposed 
to high solar 
heat loads 


Iconel X Foil 

18 - .66 

.15 


Use for low 

Use for high 

White Lacquer (Sherman Wms) 

28 

.86 

0^ = .5, when ^ 7C °F 

solar absorp- 

emittance or 





tance & high 

high absorp- 

Fuller White Silicone Paint 

25 

.9 

= .6, when ■§. 8C *F 

emittance 
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cxi, - .6 for ultraviolet 
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Optical Solar Reflector Alum* 

.1 

.744 - .807 

radiation 



coated 






Thermatrol White Silicone 



= .32 for ultraviolet 



Paint 

,16 

.95 






radiation unaffected 



S13 (ZnO/Silicone) 

119 - .2 

.79 - .87 




S13G(Zn0/Silicone) 

116 - .2 

. 84 - .86 

= .3 when deteriorated 



Z93 (ZriO/K2SiC>3) 

14 
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requires alum. surface 
as base 

LP10A (ZnSiO./KjSiOo) 



1 - .14 
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Hughes (AlSiO.KaSiOq) 
Dow Coming DC92-007 

13 - .14 
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.832 


Use for high 

Use for high 





emittance 
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Black Lacquer (Sherwin Wins) 

93 
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Use when ^ 450°F 
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high absorptance 

Fuller Black Silicone Paint 

89 

.88 
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Rokide C (Chrolic Acid) 
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When exposed 
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Platnum Black 
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Use for low , 

Fuller Alum. Silicone Paint 

25 
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Fuller Alum. Silicone .Paint 

22 
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When exposed 
to high solar 
heat loads 


Alum. Acrylic Paint 

38 - .52 

.36 - .58 

Use when -■£_ 650°F 







Table 2-40. Avionics Systems Installation 


SYSTEM 
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COMMUNICATIONS 


X 
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X 


POWER DISTRIBUTION & CONT 


* 

X XXX 

SAFING 

X 

X 
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X 




NOTE: * 1 - ACT UNITS AND INSTRUMENTATION WILL BE IN CONTAINERS LOCATED 
IN ALL AREAS OF THE ESS. 

2 - CONTAINER "K" EQUIPMENT IS SIMILAR TO THE 223 CONTAINER 

EQUIPMENT ON THE S-II STAGE. 

3 - © = RECOVERABLE CONTAINERS 
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management equipment will be housed in recoverable containers mounted on 
the thrust cone." All communications equipment including antennas will be 
mounted in the forward skirt area. (See Figure 2-184 for location. ) 

Avionics Equipment Recovery. The guidance, navigation, and control- 
equipment and data control management equipment housed in containers 
B, C, D, and E will be recovered from the ESS by retrieving the complete 
containers. The containers will be separated from the stage by severing 
the attach brackets with exploding bridge wire (EBW) initiated linear shaped 
charges (LSC). Figure 2-186 shows the explosive train used to separate each 
container. Two EBW firing units are used to provide redundant signal paths 
for initiation of the LSC assemblies. The storage capacitors in the EBW 
firing units are charged to 2300 volts by the application of 28-dc power to 
the charging circuits. A trigger signal discharges the storage capacitors, 
releasing a high-energy pulse that explodes the bridgewire in the EBW 
detonator. The resulting detonation propagates through the confined 
detonating fuze (CDF) manifolds, and CDF assemblies, and initiates each end 
of LSC assemblies. Detonation of the LSC assembly severs the webs of the 
container attaching I beams, thus separating the containers from the stage. 
The design and installation of the charge will be such that no fragmentation 
or shock loads will occur. The crossover CDF assembly between CDF 
manifolds (see Figure 2-185) provides added systems reliability. 

2. 3. 8 Recovery and Deorbit Subsystem 

The baseline ESS system provides for the recovery of the main 
propulsion engines and major components of the avionics subsystem before 
deorbiting the vehicle. In order to recover this high-cost equipment, it 
must be separated from the vehicle in preparation for retrieval by the shuttle 
orbiter. The two main engines, and selected avionics containers will have 
separation devices incorporated to facilitate recovery. The removal of the 
DCM components necessitates the incorporation of minimal control equip- 
ment to provide the capability for vehicle control during deorbit sequencing. 
This section contains the requirements, trade studies, and technical 
descriptions of the equipment required to provide the capability for equipment 
recovery and vehicle deorbit. 

Recovery/Deorbit Ground Rules, Assumptions, and Requirements 

The prime driver in establishing the requirements and techniques to 
accomplish the objective of equipment recovery is the need to maintain the 
capability to deorbit the vehicle. This section contains the ground rules, 
assumptions, and requirements considered in the development of this 
subsystem. 
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Major Ground Rules and Assumptions. The major ground rules and 
assumptions utilized in the recovery study are as follows: 

1. ESS must be capable of deorbiting. 

2. Equipment required for deorbit will be FO/FS. 

3. The initiation of the deorbit burn sequence will be controlled by 
the orbiter or ground via airlink. 

4. The OMS engines will be used to provide the deorbit delta V. 

5. The ACPS will be utilized to provide attitude control. 

6. Deorbit will be accomplished within 24 hours from launch. 

7. The shuttle orbiter will provide the attitude alignment required 
for ESS deorbit. 

8. All electrical equipment recovered will be safed (dead faced) 
before removal. 

9. All equipment to be recovered will be mounted in the aft area of 
the vehicle. 

10. Equipment separation will not endanger the orbiter vehicle. 

Requirements . The recovery and deorbit subsystem requirements are 
as follows: 


1. Recovery. Due to the extremely high cost of the ESS main engine, 
guidance, navigation, and DCM equipment, it is economically 
advantageous to recover the items from orbit for reuse. There- 
fore, the ESS must incorporate separation controls consistent 
with the ground rules and assumptions specified above. 

2. Deorbit . The deorbit equipment in conjunction with appropriate 
ESS subsystems and shuttle orbiter will provide the limited vehicle 
control required to permit recovery of the primary DCM and 
GN&C equipment. This equipment will maintain the ESS in an 
attitude hold mode for a period of up to (TBD) hours after attitude 
initiation by the primary control system or the shuttle orbiter 
vehicle. During this attitude hold period, the ESS attitude will be 
maintained within ±5 degrees of initial alignment. 
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The deorbit subsystem will also provide the means of controlling the 
subsystem sequencing during the equipment recovery and deorbit phases. 

(See Figure 2-186 for the block diagram of the deorbit package. ) 

Recovery System Description 

Equipment recovery will be initiated by separation of the main engines 
and applicable avionics containers from the ESS vehicle structure. This 
separation will be accomplished by electrical detonation of ordnance devices 
to selectively sever the mounting brackets and release the mechanical 
fasteners. The ordnance selected is nonfragmenting and will not compromise 
the safety of a docked orbiter and crew. 

The avionics containers are separated by linear-shaped charges (LSC) 
which cut the I-beam brackets attaching the containers to the primary struc- 
ture. These LSC's are detonated by dual detonators and exploding bridge 
wire (EBW) assemblies. The associated electrical control circuits to each 
EBW unit are composed of two alternate paths, which make the control 
circuitry FO/FO. (Refer to Figure 2-187. ) 

Separation of the main engines is achieved by actuating separation 
nuts. Each engine mechanical interface with the vehicle is attached with 
bolts and separation nuts which are actuated by gas -generating power 
cartridges (two per nut) which are initiated by a 5-ampere, 3-millisecond 
pulse. Each engine has 130 of these nuts; therefore, a total of 520 power 
cartridges must be fired to separate the mechanical connections of two 
engines. A typical circuit diagram for firing the separation nut power 
cartridges is shown in Figure 2-188. The electrical power and control 
cables that interface with the main engines and avionics containers to be 
removed must also be separated. This will be effected by umbilical -type 
connectors which disengage as the engines and containers move away after 
separation of their fasteners. 

Performance Analysis 

After separation from the payload, the ESS will assume an attitude 
for deorbit and apply power to its recovery and deorbit electronics package. 
The separation nuts holding the main engines will then be detonated, the 
engines will move to the limit allowed by two remaining restraining bolts, 
and a positive separation signal will be telemetered to the orbiter. The 
orbiter will then dock with the ESS, command final separation of the engines 
through the uplink system, and retrieve the engines. After engine recovery 
is complete, the avionics containers will be separated by uplink command 
and retrieved in the same manner as the engines. As presently conceived, 
equipment recovery will be accomplished by mechanical manipulator arms 
controlled from the orbiter vehicle. 
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Figure 2-186. Deorbit Package Block Diagram 
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Main Engine Recovery. Separation of the main engines for recovery 
requires an uplink command to initiate separation nut release. The decoded 
command initiates a timed sequence in the recovery /deorbit sequencer to 
fire the separation nut, power cartridges. Consecutive firing will require 
approximately 300 milliseconds. The sequencer and power cartridge circuits 
are redundant for each separation nut and operate from separate power buses. 
The total engine separation system is FO/FS; the failure of two power 
cartridges in one nut, or their firing circuits, is a safe condition even 
though the engine cannot be recovered. 

The power cartridges used to initiate separation are gas -generating 
devices. They are designed to provide high-pressure combustion energy 
to actuate the separation nuts, and they have been qualified and used in 
previous space applications. These cartridges require 4. 5 to 5 amperes 
for approximately 3 milliseconds to achieve a 99. 9 percent minimum firing 
probability with a 95-percent confidence level for single units. When used 
in pairs as they are in this design, the firing probability of each nut is even 
better. 

Initial engine separation (before orbiter docking) will allow the engines 
to move back approximately one-quarter inch and actuate switches whose 
output will be telemetered to indicate engine primary separation. After 
orbiter docking with the ESS, uplink commands through the recovery /deorbit 
sequencer will effect final separation of each engine after the recovery 
manipulator arm is attached. The flexible heat shield attached to each 
engine will be separated during the primary separation. 

Avionics Recovery. The guidance, navigation, and control equipment 
and data control management equipment housed in containers B, C, D, and 
E will be recovered from the ESS by retrieving the complete containers. 

The containers will be separated from the stage by severing the attach 
brackets with exploding bridge wire (EBW) initiated linear shaped charges 
(LSC). Two EBW firing units are used to provide redundant signal paths for 
initiation of the LSC assemblies. The voltage capacitors in the EBW firing 
units are charged to 2300 volts by the application of 28-dc power to the 
charging circuits. A trigger signal discharges the storage capacitors, 
releasing a high-energy pulse that explodes the bridgewire in the EBW 
detonator. The resulting detonation propagates through the confined deton- 
ating fuse (CDF) manifolds, CDF assemblies, and initiates each end of LSC 
assemblies. Detonation of the LSC assembly severs the webs of the 
container-attaching I-beams, thus separating the containers from the stage. 
The design and installation of the charge will be such that no fragmentation 
of shock loads will occur. The cross-over CDF assembly between CDF 
manifolds provides added systems reliability. 


2-460 


SD 71-140-2 



© 

Separation, type connectors will disconnect upon cutting of the mounting 
I-beams, due to a 1-inch downward motion induced by a spring mechanism. 

The control circuits for arming and firing the two EBW units, for each 
container separation system, will be dual paths for each EBW. To separate 
each container, an uplink command must be received and decoded and a 
discrete command sent to the sequencer to arm/trigger the EBW's. Each 
container will require two uplink commands to accomplish the separation. 
(Refer to Figure 2-188 for a block diagram of the proposed circuits.) 

During ground checkout of these circuits, pulse sensors will be 
installed in place of the flight ordnance. These pulse sensors verify the 
functional operation of the EBW’s without actually detonating an ordnance 
train. 


During ground checkout, the entire system, excluding the uplink 
portions, may be functionally checked by the DCM system through an ACT 
unit interface. The ACT unit will not be active during flight in order to 
eliminate the possibility of an inadvertent container separation. 

During recovery operations, the orbiter manipulator arm will be 
attached to a container handle, shown in Figure 2-189, and the separation 
ordnance will then be fired. The spring-loaded connector interface will 
disengage the electrical connectors by pushing the container down, and the 
manipulator will retract and remove the container for stowing in the orbiter 
cargo bay. Each container will be separated individually after the manipulator 
is attached and ready to remove it. 

Figure 2-99 shows a conceptual design for gaining access to the 
astrionics containers through the fiberglass honeycomb heat shield. A firm 
design for this closeout separation is to be determined. 

Deorbit Subsystem Description 

The deorbit subsystem includes the hardware required to accomplish 
ESS deorbit, after the primary DCM and guidance and navigation avionics 
equipment have been recovered. This subsystem is composed of four major 
elements: (1) uplink data decoder, (2) deorbit/recovery sequencer, (3) flight 
control logic, and (4) vehicle attitude sensors. 

The deorbit equipment provides vehicle stabilization and deorbit/ 
recovery sequencing once the primary DCM and GN&C equipment is deacti- 
vated in preparation for recovery. The up-link data decoder will provide the 
interface between the deorbit equipment and the ESS communication subsys- 
tem. This interface is required to meet the requirement of external control 
for the initiation of the deorbit sequence. 
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The deorbit /recovery sequencer will provide the preprogrammed 
sequence and the inhibit signals required to effect vehicle sequencing during 
the recovery and deorbit phase of the ESS mission. 

The flight control logic element of the deorbit subsystem provides the 
capability to interpret the vehicle attitude information provided by the 
sensing element and to transform this information into control signals for 
the ACPS to maintain proper vehicle attitude and thrust vector control (TVC) 
during OMS engine burn. 

The vehicle attitude - s ensing element provides the information required 
to maintain proper vehicle alignment for deorbit. This element enables the 
ESS to maintain the vehicle alignment established by fhe primary system 
before deactivation or that established by the orbiter before separation. 

Figure 2-190 is a schematic /block diagram of the deorbit equipment 
with interfaces required with the primary ESS subsystems. The deorbit 
equipment will be in a nonenergized state through the initial phases of the 
ESS mission. This condition will exist until after payload separation from 
the ESS. After payload separation, the primary DCM system will initiate 
action to cause the ESS to assure a vehicle attitude suitable for deorbit. 

This maneuver is performed before activation of the deorbit equipment as 
a precaution to preclude any perturbations during the deorbit equipment 
activation which might prevent safe deorbit of the vehicle. Once the pre- 
liminary deorbit attitude has been attained, the deorbit/recovery equipment 
will be activated. The equipment will be activated but will remain in an 
inhibited state until such time as the DCM system has completed all opera- 
tion associated with safing the main engine (dead facing electrical connectors) 
and preliminary separation of the main engines. 

At this point, an up -link command will be required to remove the 
primary DCM system as the controlling source and enable the deorbit equip- 
ment to provide attitude control. 

Utilizing the input from the two-axis position gyro and the three-axis 
rate gyro, the flight control logic will generate appropriate control signals 
to fire the ACPS thrusters to maintain the attitude established by the primary 
guidance and control equipment before deactivation. The system will remain 
in this mode of operation until such time as it is directed to commence 
preparation of the DCM and GN&C equipment for recovery. Under control 
of an external command, the deorbit/ recovery sequencer will initiate those 
commands required to safe the avionics equipment and initiate its 
separation. 
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At the moment of orbiter mating with the ESS, the deorbit attitude 
control system will be switched to a standby mode. While the orbiter is 
mated to the ESS, the deorbit equipment will perform only those operations 
which are commanded through the up-link by either the orbiter or ground 
control. This will include final separation of the main engines and avionic 
containers. 

Before separation of the orbiter from the ESS, the orbiter will align 
the ESS with the final attitude orientation for deorbit. At this point, the 
deorbit attitude control will be enabled in such a way that it may retain any 
change in attitude at the time of separation of the orbiter from the ESS. 
However, the control of the ACPS system will not be enabled until such time 
as the orbiter is a safe distance from the ESS. This is to preclude any 
damage to the orbiter should the ESS malfunction at this time. 

The ESS will maintain an attitude-hold mode of operation until such 
time as an external command is received to initiate deorbit. The sequence 
of events from the time of payload separation through deorbit is as follows: 

1. Establish deorbit attitude 

2. Activate deorbit equipment 

3. Dead-face engine equipment 

4. Initiate preliminary engine separation 

5. Activate deorbit attitude contrbl; deactivate primary control 

6. Initiate deadfacing or recoverable avionics equipment 

7. Mate with orbiter, deactivate attitude control 

8. Perform main engine retrieval 

9. Open ESS aft closeout panels 

10. Initiate avionics container separation 

11. Retrieve avionics containers 

12. Align ESS to deorbit attitude (using orbiter NG&C) 

13. Activate ESS attitude control system with ACPS engines inhibited 

14. Separate orbiter 
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15. 



Back away orbiter; activate ACPS 
16. Initiate deorbit sequence 

Control of the deorbit delta- V engine burn will be effected by two 
means. The primary control of the delta-V burn duration will be provided 
by the output of an integrating accelerometer which will initiate OMS engine 
cutoff after the proper delta V has been obtained. This system will be 
backed up by an output of the deorbit sequencer; this output will occur at a 
predetermined time after engine start. This time will be automatically 
adjusted to account for one engine out either at the start of deorbit or any 
time during the delta- V- burn, ■ 
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2. 4 ESS VEHICLE INSTALLATION, ASSEMBLY, AND CHECKOUT 
2. 4. 1 Major Vehicular Installation 

The ESS will be fabricated as three 'major subassemblies: the forward 
skirt, which interfaces with the payload; the LH 2 /LO 2 tank that comprises 
the major portion -of the stage; and the aft skirt, in which the main and ■ • 
auxiliary engines are mounted. The various' subsystems will, be installed 
in these subassemblies prior to final joining wherever feasible; thus the 
installation effort will be allowed to proceed on each module simultaneously. 
This approach reduces the time required for any given installation because 
of the greater freedom of access, reduces the possibility of damage to the 
stage, and allows individual system testing to take place at a much earlier 
time so that substantial cost savings result. 

The forward skirt installations will consist primarily of mounting 
various portions of the avionics and payload separation systems. The sub- 
systems will be assembled in their environmental protection containers and 
tested in another area. The subsystem containers will be mounted on 
previously installed brackets, the stage wire harnesses will be installed, 
and a continuity and megger check will be made. The LH^ tank propellant 
utilization, vent, pressurization, and instrumentation systems will be 
installed with the tank in the horizontal position after the postpneumostat 
cleaning operation, the LC >2 tank systems having been installed after the 
placement of the tank in the vertical position in the installations station. 

The aft skirt installations include the data control management and naviga- 
tion, guidance, and flight control avionics containers. The auxiliary pro- 
pulsion system cryogenic tanks and the propellant system lines will be 
installed and proof-tested and the engine actuation systems installed and 
checked out in the aft skirt subassembly prior to the final assembly joining 
in the Vertical Assembly Building. 

2. 4. 2 Final Assembly and Installation 

Final assembly of the ESS will be accomplished in the existing Vertical 
Assembly Building (VAB) at the NASA Seal Beach facility. The forward 
skirt, the LH 2 /LO 2 tank, and the aft skirt will be mated and then moved to 
the spray foam station where the stage will be rotated in the vertical position 
while portions of the forward skirt, the tank areas (previously left bare for 
weld inspection), and portions of the aft skirt (requiring spray foam insulation) 
will be sprayed and machined smooth. 
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After the application and machining of insulation, the stage is moved 
to the installations station in the YAB where the engines, attitude control 
propulsion system (ACPS) thrusters, remaining avionics containers, and 
stage system fairings will be installed. The erosion barrier honeycomb 
panels will be installed at this point, along with the forward and aft skirt 
thermal protection covers not previously installed. 

2. 4. 3 ESS Acceptance Checkout 

Acceptance testing is designed to-verify that hardware produced by 
production metnods under quality control procedures and ready for delivery 
to its next assembly or usage point complies with specifications, is free 
from defects, and is capable of performing in conformance with stated con- 
tractual requirements. Acceptance tests begin with vendor tests at the 
subassembly, component, assembly, and subsystem level and continue 
through demonstration at the time of vehicle delivery (or turnover) and 
customer acceptance. 

Whenever appropriate, acceptance tests at the component/ subassembly 
level will include environmental testing. Environment test levels will be 
equivalent to mission requirements or a level sufficient to screen defects. 
The contractor will make recommendations concerning which items of 
hardware should be considered for environmental acceptance testing. The 
tests will be designed to detect manufacturing flaws, workmanship errors, 
and incipient failures v/hich are not readily detectable by normal inspection. 

Acceptance testing at the subsystem level (installed in the vehicle) will 
include a demonstration of alternate /redundant modes of operation — together 
with malfunction switching logic — by exercise of subroutines inherent to the 
data control and management system. Whenever possible, alternate/ 
redundant path checkout capability by malfunction simulation will be an 
inherent subsystem checkout feature and will be accomplished without 
disturbing the flight configuration. 

Upon completion of assembly and in-line manufacturing acceptance 
tests, such as leak checks and continuity and megger tests, each subsystem 
will undergo a functional acceptance test during po st -manufacturing checkout 
(PMC). The PMC will culminate in an integrated noncryogenic simulated 
flight test designed to verify that all subsystem interfaces are correct and 
that no extraneous interactions exist. 

2. 4. 4 Manufacturing Facilities 


The facilities plan is to use existing government -owned facilities, 
contractor-owned facilities, and facilities available through other government 
contractors for detail and component fabrication. The subassembly and 
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assembly activities will be accomplished at the NASA Seal Beach assembly 
facility,, which was designed and built expressly for production of the 
Saturn S-II, of which the ESS is a derivative. The 33 -foot diameter and 
80 -foot length of the S-II posed special transportation problems, leading to 
the choice of Seal Beach as having facilities nearby for shipping the complete 
stage by ship through government- controlled facilities. In addition, it is in 
the center of a manpower pool of skilled individuals and is near the sites of 
many subcontractors — facts resulting in reduced costs for transportation, 
coordination, and testing. 

The recommended facility utilization plan embraces development, 
qualification, and acceptance testing at the NR Downey facility, NR Seal Beach 
facility, MSFC, KSC, Wyle Laboratories (Huntsville), and wind tunnels as 
needed and available at Langley Research Center, Ames Research Center, 
or at AEDC Von Karman gas dynamics facility; detail fabrication at the NR 
Downey facility, the NR Los Angeles facility, and at selected subcontractors; 
and subassembly and assembly at the NASA Seal Beach assembly facility. 

The NASA Seal Beach assembly facility contains adequate floor space to 
accommodate the ESS production operations and provides sufficient bridge 
crane capacity to handle the movement and transfer of subassemblies and 
as semblies. 
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2. 5 ESS SYSTEM SUPPORT 
2. 5. 1 Support Equipment 

The objective of this study has been to determine new support equip- . 
ment or existing support equipment to be modified to support the servicing, 
checkout, handling, and the launch of the ESS. (Saturn S-H support equip- 
ment not requiring modification for the ESS is not included in this report. ) 

New support equipment and modifications to existing equipment are 
required to accomplish servicing, checkout, and acceptance tests at Seal 
Beach; servicing, checkout, and static firing tests at KSC; and the servicing 
and checkout at the launch pad to support the ESS launch. 

The report includes new and modified handling and auxiliary equipment 
to be utilized to transport the ESS at Seal Beach and KSC and to install or 
remove stage-oriented equipment at all facilities. 

Umbilical Equipment 

Umbilical installation at KSC will be accomplished from a new service 
tower permanently located on the launch pad near the southwest corner of the 
mobile launcher. 

The location of the umbilicals on the ESS were changed (as compared 
with those on S-II) to accommodate the new launch tower and swing arms. 

The new umbilical centerline is 25 degrees from position I in the direction 
of position II. Station 206 on the ESS is the same as Station 233 on the S-II 
for the aft umbilical carrier plate (A7-41); and Station 831 on the ESS is the 
same as Station 930 on the S-II for the forward umbilical carrier plate 
(A7-4Z). 

The LH 2 fill disconnect (A7-64) and the LC >2 fill disconnect (A7-65) 
will be relocated also. 

Seal Beach facilities will have to be modified to provide umbilical 
connections on the new stage locations. 

ESS requirements for the following umbilical end items will result in 
minor changes only and will not affect their qualified status. 

A7-42 Forward umbilical disconnect carrier plate assembly 

A7-62 Forward umbilical fixed plate assembly 

A7-64 LH 2 fill and drain propellant disconnect assembly 
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A7-65 LO 2 fill and drain propellant disconnect assembly 
A7-66 LH£ propellant static firing coupling assembly 
A7-67 L,C >2 P ro P e H an ^ static firing coupling assembly 

A7-69 LH 2 coupling support assembly 

A7-70 LC >2 coupling support assembly 

A7-41 Aft Umbilical Disconnect Carrier Plate Assembly . The aft 
umbilical carrier plate will be modified to satisfy ESS requirements. 
Disconnects used on the S-II stage are utilized wherever possible. Two new 
disconnects will have to be developed and qualified. The new 2-inch dis- 
connect for the APS LH 2 tank fill and drain will be located off the present 
carrier plate. Attachments will be provided, and a limited qualification test 
program will be conducted to verify carrier plate ejection. The electrical 
umbilical interface is sufficient to satisfy ESS requirements. New disconnect 
requirements are as follows: 


Disconne ct 
Size 
(in. ) 

Maximum 

pressure 

(psig) 

Disconnect 

Part 

Number 

Nomenclature 

2 

15 

New 

APS tank fill and drain 

1 

15 

ME144-0011 

APS BH 2 tank vent 

1/2 

1200 

ME144-0010 

• APS LH 2 tank and accumulator 
pre -pressurization supply 

1/2 

1200 

ME144-001 0 

APS LO 2 tank and accumulator 
pre -pressurization supply 

1 

4700 

New 

Main engine helium supply 

1 

1300 

ME144-001 1 

Main engine GN 2 purge supply 


A7-61 Aft Umbilical Fixed Plate Assembly . The fixed aft umbilical 
plate assembly for Seal Beach checkout will be modified for use on the ESS. 
New hardline connections and support brackets will be added. A new 2-inch 
coupling will be developed and attachments will be provided to support the 
APS LH 2 tank fill and drain system. No major changes on the electrical 
interface are anticipated. 
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Pneumatic Servicing and Checkout Equipment 

The ESS will require the support of GSE at the KSC launch pad and at 
Seal Beach for the Station 9 type of checkout operations. Limited checkout 
at KSC will be supported by the S7-41 pneumatic servicing console. Opera- 
tions at Seal Beach will utilize the C7-603. Modifications of this equipment 
will be required to support the stage systems changes which represent 
deltas over and above the S-II-15 configuration. Requirements affecting the 
S7-45 leak detection and purge console will require no equipment modifica- 
tion. No requirements exist for cryogenic gases, and the A7-71 heat 
exchanger will not be utilized for this program. Pneumatic circuits of the 
S7-41 normally routed through the A7-71 will be revised by routing tubing to 
replace and complete the circuit that would normally pass through the A7-71. 

Equipment modifications required to support new or changed require- 
ments are described below. Utilization of existing nonfunctional equipment 
or circuits currently contained within the end-items will be made to the 
fullest possible extent as the most cost-effective approach. 

S7-41 Pneumatic Servicing Unit . 

ESS-Auxiliary Propulsion System GH 2 Charge, Fill, Pneumatic 
servicing {1100 psig GHg AMB) for this function will be supplied by the 
existing start tank pressurization circuit contained in the S7-41 D section 
(FJA7205). The system will be modified to add orifice flow control to meet 
the 5 lb/min GHg servicing requirement. Regulators, relief-valves, and 
pressure switches will be adjusted to conform to the reduced pressure of 
1100 ± 100 psig for ESS requirements. 

ESS-Auxiliary Propulsion System GOg Charge, Fill. Pneumatic 
servicing (1100 psig GO 2 AMB) for this function will be supplied by the 
existing thrust chamber purge and chilldown system contained in the 
S7-41 A and B sections. Modifications will be required as follows. In 
the B section the ambient helium supply (FJA9202) will be isolated from the 
thermocouple circuit by breaking the system and capping lines downstream 
of check valve A9002, Relief valve A15557 will be readjusted to match the 
1100 psig pressure level. In the A section, the existing thermocouple 
circuit will be modified by isolating the supply from the helium manifold and 
capping the manifold. A new primary regulation system consisting of a 
new GO 2 facility supply disconnect, a manual shutoff valve, a filter, gage, 
a transducer, a pneumatically operated supply shutoff valve, a solenoid actu- 
ation valve, a dome hand-loader regulator and solenoid shutoff valve, a 
dome-loaded regulator, gage, transducer, and a calibration valve will be 
added and connected in series to the existing secondary regulator A8991. 
Regulator A8990 and A8991, transducer A15922, pressure switch A8992, and 
relief valve A8995 will be adjusted to new settings consistent with the required 
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pressure level of 1100 psig. Backpressure regulator A15934 and associated 
check valve A15936 will be deleted from the system and the system capped, 

A new interface facility supply of AMB GC >2 at 6000 to 3400 will be required 
to supply the system. 

ESS-Auxiliary Propulsion System GH 2 Charge, Purge, Pneumatic 
servicing (TBD psig GN 2 , AMB) for this system will be supplied by the 
addition of a new regulation supply system to the S7-41 B section. The 
new system will consist of a pressure regulator and associated pressure 
monitoring instruments, control valves, and relief protection devices to 
supply the GN 2 purge. A downstream selector supply valve will be provided 
to the H 2 auxiliary propulsion system purge for purge supply control. 

ESS-Auxiliary Propulsion System GOg Charge, Purge, Pneumatic 
servicing (TBD psig GN 2 AMB) for this system will be supplied by the new 
regulation supply system described for the auxiliary propulsion system GH 2 
charge arid purge. A second downstream selector supply valve will be pro- 
vided for purge supply control to the GO 2 auxiliary propulsion system purge, 

ESS-Main Engine Purge Supply. Pneumatic servicing (1250 ± 100 psig 
GN 2 AMB) for this function will be supplied by the existing LOg tank nitrogen 
purge system contained in the S7-41 B section. Modification will be required 
as follows. In the B section, ambient GN 2 supply (A9198) will be isolated 
from trie LO 2 tank helium pre-pressurization circuit by breaking the system 
and capping lines downstream of pneumatically operated valve A9117. A new 
independent line system and components will be added downstream of 
pneumatically operated valve A9117 to supply GN 2 to the ESS and to provide 
venting, relief flow control, filtration, and pressure monitoring capability. 
Components to be added are a pneumatically operated vent valve and control 
solenoid valve, a relief valve, a flow orifice, a filter, a pressure switch, 
a transducer, and a calibration valve. In the S7-41 A section, existing 
regulators A9027 and A9028, pressure switch A9029, and relief valve A9032 
will be adjusted to correspond with the required 1250 psig supply pressure. 

ESS-Main Engine Helium Supply, Fill. Pneumatic servicing (4500 ± 200 
psig He AMB) for this function will be supplied by the addition of a new 
independent system in the S7-41 B section. The new system will consist of 
an inlet supply manual isolation valve, a filter, a pres sure -monitoring 
instrumentation, a pneumatically operated supply shutoff valve, and an 
associated control solenoid. The regulation system will consist of a primary 
and secondary dome -loaded regulator and associated hand loaders and dome 
supply solenoid isolation vent valves. The regulation system will be provided 
with relief valve protection, pres sure -monitoring instrumentation, and manual 
vent valve. The downstream system will contain a pneumatically operated 
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supply shutoff valve, a pneumatically operated vent valve and related control 
solenoids, a flow control orifice, and a downstream filter. The system will 
require a facility interface supply of 6000 to 4500 psig AMB, helium at KSC. 

Electrical Requirements. Existing pneumatic modules, new modules, 
and the electrical J-box located in the S7-41 will be rewired to supply check- 
out and .servicing pressures for the following ESS requirements. 

1. Main engine helium supply fill 

2. Main engine purge supply 

3. Auxiliary propulsion system GHg charge, fill 

4. Auxiliary propulsion system GHg charge, purge 

5. Auxiliary propulsion system GO 2 charge, fill 

6. Auxiliary propulsion system GOg charge, purge 

New pressure transducers {different pressure ranges) may be 
necessary to fulfill the new requirements. 

The solenoid valves, valve position limit switches, pressure switches 
and transducer outputs will be wired to an interface connector, providing the 
ESS with the necessary output/input signals for control and monitoring of 
the S7-41. 

S7-42 Pneumatic Servicing Electrical Console . The pneumatic 
servicing electrical console (S7-41) is an electromechanical unit used to 
command and sequence the electrical and pneumatic components in the 
associated GSE that services the stage's systems and components during 
preparation for checkout or static firing. All commands and feedback 
signals from the various GSE pass through the S7-42. 

The modification and addition of pneumatic systems in the S7-41 would 
require additional relay modules and the reprogramming of the patch boards 
to provide the necessary logic, control, and distribution of feedback indica- 
tions from the new and modified systems in the S7-41. 

Additional changes such as nomenclature, interfaces, pressure ranges 
and settings, etc. , must be made to be compatible with the ESS systems. 
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S7-45 Leak-Detection and Purge Console. No revisions will be 
required for the S7-45 leak-detection and purge console to satisfy the ESS 
purge requirements. 

C7-50 Transducer Set, Manual Pressure Checkout. The C7-50 is a 
portable case containing pressure transducers of various ranges. It is used 
in conjunction with the C7-603 (pneumatic checkout console) to provide the 
necessary pressure signals for monitoring, recording, and control purposes. 
The new requirements of the ESS system will dictate that some of the trans- 
ducers be replaced with different ranges. 

C7-70 Pneumatic Console Test Set . The C7-70 pneumatic console test 
set consists of six portable type cases. Two and one-half of the cases are 
used to provide storage space for control, for monitoring, and for the power 
cables used to connect the C7-70 test set to the S7-41, A7-71, S7-49, and 
S7-45 GSE. The other three and one-half cases contain electrical panels, 
which are equipped with switches, lights, and meters to checkout the 
solenoid valves, transducers, pressure switches, and wiring located in the 
S7-41, A7-71, S7-45, and S7-49 GSE. 

Modification of the S7-41 would require that existing circuits be modi- 
fied to meet the new checkout requirements. Additional changes, such as 
nomenclature, interfaces, and pressure ranges, must be made to be 
compatible with the ESS system. The A7-71 and S7-49 will not be used on the 
ESS program. 

C7-603 Pneumatic Checkout Console . 

ESS-Main Engine Helium Supply Fill, This function will be supplied 
by the existing engine helium bottle fill supply module G7-873315 in the 
C7-603 automatic section. Pressure supplied by this module will service 
functional and leak check requirements at 1500 psig GHe. 

ESS-Main Engine Purge Supply. This function will be supplied by the 
existing GH 2 start tank supply. A supply of 500 psig GHe will be available 
to the new system for leak-check purposes from existing module G7-870635 
contained in the C7-603 manual console. 

ESS-Auxiliary Propulsion System GH^ Charge, Fill. Pneumatic 
servicing (1000 psig GHe) for this function will be provided by the existing 
module G7-870042, previously used to supply LH 2 and LO 2 pressurization 
regulator bias checkout supply (GHe at 860 psig). The' module plumbing 
system and components will be upgraded and requalified for service at the 
higher (1000 psig) pressure. Selector valve G9LV38 will service the 
auxiliary propulsion system GH 2 charge system of the ESS. 
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ESS-Auxiliary Propuslion System GO 2 Charge, Fill. Pneumatic 
servicing for this function will be provided by the existing module G7-870042. 
Modifications for this module are described under ESS-Auxiliary Propulsion 
System GHg Charge Requirements. Selector valve G9LV39 will service 
the auxiliary propulsion system GO 2 charge system of the ESS with GHe 
at 1000 psig. 

Switch light and control panel nomenclature for all of the systems 
described will be revised to agree with the servicing functions.. 

Electrical Requirements. Existing pneumatic modules and control 
panels located in the C7-603 automatic, manual, and recorder racks will be 
rewired to supply checkout pressures and servicing pressures for the 
following ESS requirements: 

1. Main engine helium supply fill 

2. Main engine purge supply 

3. Auxiliary propulsion system GO 2 charge, fill 

The recorder rack distributor will be rewired to provide access to any 
new stage components (control and feedback indications) required to perform 
a manual leak check of the stage's pressurization system. The existing 
control, monitor, and recorder patch panels located in the automatic, manual, 
and recorder rack will be modified to accept the new'requirements. Wiring 
changes due to interface changes will be accomplished in distributors located 
in the C7-603 racks. 

Changes such as thosq in nomenclature, interfaces, pressure ranges 
and settings, etc. , must be made to be compatible with the ESS system. 

Model 961 Audio-Visual Alarm System. The audio-visual alarm 
system is a unit consisting of pressure switches, warning horns, and flash- 
ing lights. Its purpose is to provide an audio and visual warning signal to 
alert personnel when the propellant tank pressures have reached an impend- 
ing danger point. The present system can be utilized for the main propulsion 
system propellant tanks. However, the Model 961 must be expanded in a 
similar manner to provide an audio-visual warning system for the auxiliary 
propulsion system propellant tanks. 

A recording system will be added to provide a -permanent record of 
propellant tank pressures. This would allow the continuous recording of 
pressures 24 hours a day, seven days a week. This information is useful in 
the event that an overpressure condition occurs when no personnel are 
present. 
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GH ? ' Free Hydrogen Burnoff System. Two hydrogen burner assemblies 
will be required at KSC to support static firing. The systems will be similar 
to the SDD-235 utilized at MTF for the S-II program. 

Flame Detector Unit. A flame detector unit will be required for static 
firing at KSC. The unit will be similar to the SDD-254 utilized at MTF for 
the S-II program. 

Fluid Distribution System (S B Station 9) . 

Main Engine Helium Supply, Fill. Reroute the existing engine helium 
bottle fill line flexible hose to a new interface on the aft umbilical carrier 
plate. 


Main Engine Purge Supply. Reroute the existing GH 2 start tank fill 
line flexible hose to a new interface on the aft umbilical carrier plate. 

Auxiliary Propulsion System GH 2 Charge, Fill. Reroute the existing 
L.H 2 tank regulator checkout line from tne forward umbilical carrier plate to 
the aft umbilical carrier plate. 

Auxiliary Propulsion System GO 2 Charge, Fill. Reroute the existing 
LO 2 tank regulator checkout line flexible hose to a new interface on the aft 
umbilical carrier plate. 

LO 2 Tank Vent Valves. Reroute the LO 2 tank vent ducting -to the new 
interface on the ESS. Add new supports for the additional length of line. 

Portable LO 2 Vent Valve Checkout System (KSC) . Add a new LO 2 tank 
vent valve vacuum checkout system similar to the LH 2 tank vent valve system. 
This system will connect from the S7-29 to the two new interfaces located 
near the LO 2 vent valves, and will include tygon tubing, valves, transducers, 
and supports. 

Handling and Auxiliary Equipment 

The handling and auxiliary equipment required to support the ESS for 
transportation, lifting, access, static firing, and miscellaneous component 
handling and installation functions will include existing S-II end items , 
modified S-II end items, and new end items. The following list includes new 
and modified end items which are required due to the addition of new compo- 
nents and configuration changes in- the aft compartment area. 

Engine Protective Frame (New) . This frame will provide support for 
the aft stage cover and will provide environmental and physical protection 
for the ESS engine compartment during handling and transportation. The 
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frame will be constructed of tubular members formed into a cylinder-like 
structure around the perimeter of the engines. 

Aft Stage Cover (New). This cover will provide environmental protec- 
tion for the ESS engine compartment during handling and transportation. 

The cover will be constructed of a flexible lightweight material to be installed 
over the engine protective frame. 

Orbiter Engine Installation Adapter (New). This new adapter., in 
conjunction with GFE installers, will be utilized to install and remove the 
orbiter engines. The adapter function and construction will be similar to 
the J-2 engine installation adapters. 

QMS Engine Installer (New) . This new installer will be utilized to 
install and remove the OMS engines. The function and construction will be 
similar to the J-2 engine installers. 

Tank and. Accumulator Installation Set (New). This set will be com- 
prised of equipment that will be utilized to install and remove various helium 
receivers, OMS LHg and LO 2 tanks, and thruster GH 2 and GO 2 accumulators. 
The construction and usage description is not known at this time. 

Miscellaneous Component Handling Adapter Set (New). This set will 
consist of a storage container and a set of adapters designed to assist in the 
removal and installation of various components (i. e. , LH 2 and LO 2 prevalves, 
auxiliary propulsion thrusters, etc. ) on the ESS. The construction and usage 
description is not known at this time. 

Air Stream Deflector Dolly (New) . This dolly will support and provide 
mobility for the air stream deflector which will be installed at KSC. It will 
be constructed of structural steel assembled to form a trailer-type frame. 

The dolly will be equipped with attachments for the deflector, front and rear 
undercarriages, running lights, and reflectors. 

Engine Area H 2 Q Firex System (New) . This system will provide the 
capability to extinguish fires occurring in and about the ESS engines during 
static firing by providing distribution of water in and around the engine 
compartment. The system will be constructed of components and pipe formed 
into manifolds around the engines with nozzles located to provide an effective 
water spray to the engines. 

Engine Area GN 2 Purge Manifold (New). This manifold will provide 
for purging of the ESS engine area (boattail area) during static firing when- 
ever high concentrations of propellant gas or a fire has been detected. The 
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manifold will be constructed of tubular structures designed to attach to the 
facility supply manifold and extend inward toward the orbiter engines. 

Engine Area Fragmentation Shield (New) . This shield will provide 
protection for the equipment in the ESS engine compartment in case of orbitei 
engine explosions during static firing. The shield will be constructed 
similarly to the S-II fragmentation shield. 

Engine Area Heat Shield (New). This shield will provide protection for 
the ESS- structure and equipment in the engine compartment area from the 
radiative heat generated by the orbiter engines during static firing. The 
shield will be constructed similarly to the S-II heat shield. 

Engine Servoactuator Piston Position Indicators (New) . These indica- 
tors (different configuration for orbiter and OMS engines) will be used to 
indicate visually the position of the piston in the hydraulic servoactuator, or 
the angular position of an engine in terms of the actuator stroke. The 
indicators will be constructed into a cylindrical structure having an indicator 
rod within the cylinder, and attaching me chanica-Ily to the servpactuator body 
with the rod attaching to the rod end. The indicator will have a linear and a 
vernier scale. 

Engine Actuator Locks (New). These locks (different configuration for 
orbiter and OMS engines) will be utilized to immobilize the engine servo- 
actuators to prevent any relative motion between the actuator body and the 
rod during ground handling and transportation operations. The locks will be 
constructed into a split locking collar and- a clamp for securing the collar to 
the actuator. 

Engine Actuator Simulator (New). These simulators (different con- 
figurations for orbiter and OMS engines) will provide a stabilizing element 
for a neutrally positioned engine when the engine actuator is removed. The 
simulators will be constructed- to include a strut equipped with end fittings 
duplicating those of the engine actuators. 

Hydraulic System Installation Fixtures (New) . These fixtures 
(different configurations for orbiter and OMS engines) will be utilized to build 
up and functionally check out the hydraulic system and install it on the ESS as 
a unit. The fixtures will be constructed into a tubular mobile frame with 
arms, handles, control devices, and hydraulic interfaces. 

Engine Actuator Componen t Tool Set (New). This set will consist of a 
container and a set of tools designed to assist in the removal and installation 
of hydraulic components (i. e. , upper pin remover, bench measurement tool, 
support tools, etc. ) on the ESS. The construction and usage will be similar 
to the S-II tools. 
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Engine Compartment Center Area Platform (New) . This platform will 
provide support for gaining access in the ESS engine compartment center 
area to enable maintenance therein when the stage is in the vertical position. 
The platform will be constructed of lightweight material in segments to per- 
mit easy installation and removal. 

Aft Support Ring, H7-3 (Modified). The modification of the H7-3 is 
required to provide the proper mounting interface to the ESS aft skirt and to 
extend the aft support ring interface to accommodate the existing S-II stage 
transporters. The modification will consist of adding an A-fr'ame extension 
(approximately 16 inches) to the I-beam, which will interface with the stage. 

Engine Compartment Platform Set, A7-84 (Modified). This modifica- 
tion will consist of redesigning the segments of the Station 30 platform at 
Positions I and II to allow for clearance of the orbiter engine bells. The 
Station 114 platform may have to be lowered to allow clearance of the thrust 
cone. The heat shield protective set will have to be modified due to the new 
configuration of the heat shield. 

LOg Tank Access Platform SDD-258 (Modified), This modification will 
consist of extending the platform upward in the thrust cone to gain access to 
the LO 2 manhole. This change is required due to the lowering of the thrust 
cone and the additional components installed in that area. 

Thrust Cone Access Ladder, A7-85 (Modified). This modification will 
consist of either extending or shortening the ladder, depending on the design 
change to the A7-84 in relation to the thrust cone. 

LHg Tank External Entry Equipment, SDD-32 (Modified). This 
modification will consist of redesigning the outer attach fittings for the 
platform cable supports and hoist support. This change is required because 
of the upper payload vehicle configuration change, since this equipment is 
used in the stacked condition, 

2. 5. 2 Support Software 


Software required to support the ESS checkout, acceptance, launch, 
and flight mission will be developed for the shuttle program with minimum 
changes necessary to adapt to the ESS. In conjunction with the usage of the 
support software, the use of the Avionics Systems Integration Laboratory 
(ASIL), configured to the ESS requirements, will be required to verify and 
certify the software is properly adapted and will support the ESS. The 
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following modular software items will be involved in developing software 
for the ESS: 

Ground checkout 

Simulated flight 

Prelaunch 
Vertical launch 
Orbital coast 
Rendezvous 
Stationkeeping 
Payload separation 
Equipment recovery - 
Deorbit 

The philosophy of maximum use of shuttle -developed hardware and 
subsystems will afford maximum use of modular software developed for 
comparable use on the Shuttle Program. Commonality is further enhanced 
by use of common GSE (UTC) and by use of the ASIL for verification of ESS 
software. 

2. 6 WIND TUNNEL MODELS 

Models of the expendable second stage with three payload configurations 
simulated were built to 0. 0031 scale. These payloads were the space station, 
reusable nuclear shuttle, and space tug configurations. Each model was 
mounted on a 0. 0035-scale model of the General Dynamics B-15 B-l booster, 
as well as being separately mounted and tested. The difference in scale is 
because of an attempt to simulate the later B-9U booster configuration by 
matching the ESS to the B-9U body size. Models are described in detail in 
Volume III in Section 3. 0. 
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3.0 RELIABILITY 



This section presents the ground rules, results, and conclusions of 
the expendable second stage (ESS) Phase B reliability analysis. The 
reliability analysis consisted of performing single point failure mode effect 
analysis (FMEA), wherever applicable, and a written analysis of each major 
s ubsystem. 

The basic failure criteria for the ESS is that it will not degrade the 
fail- operational, fail-safe (FO/FS) requirement of the booster during mated 
boost and booster /ESS separation. Following the safe separation from the 
booster, the basic ESS requirement is to fail safe; however, with 
vehicle operation in the proximity of any manned vehicle, the ESS opera- 
tional systems must meet FO/FS criteria. The FO/FS system requirement 
for the successful completion of the deorbit phase of the mission is also 
considered to be a mandatory requirement. 

3. 1 SUMMARY 

The reliability analysis of the ESS major subsystems determined that 
the ESS generally meets the design requirements established for the various 
phases of mission operation. The areas in which the fault tolerance levels 
have not been completely complied with are primarily associated with the 
use of existing S-II subsystems and components. The ESS system areas 
contain failure modes which can prevent the starting of one or both main 
engines and can cause the loss of the main engine(s) during the burn period. 
These failure modes exist for the present S-II stage and are considered to 
have a low probability of occurrence because of the extensive system/ 
component testing including the successful flight experience to date. 

These single -point failures consist of the inadvertent opening of the 
dual parallel main tank vent valves or the propellant tanks fill valves which 
can cause both main propulsion engines to become inoperative, and result 
in the complete loss of the mission. Other failures of this category 
which can affect the startability of the main propulsion engines are 
associated with normally open engine recirculation conditioning system 
valves (prevalves and recirculation return) failing closed. 

The failure of both main engines to start while mated to the shuttle 
booster can present a safety hazard to the booster crew because of the 
proximity of the ESS stage to the booster's vertical stabilizer during the 
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separation maneuver. Additional analysis is contemplated to determine 
if the condition is completely safe. 

The auxiliary propulsion system (APS) is a new system with no test 
or flight experience available from any other vehicle. The APS will utilize 
the basic system design and reliability concepts presently proposed for the 
shuttle orbiter. The APS consists of the orbital maneuvering system (OMS) 
and the attitude control propulsion system (ACPS). The maximum fault 
tolerance level of FO/FS was established for the QMS to meet the require- 
ments .for deorbit. The APS has several single point failures (operational 
failure of system components) which could cause one of the OMS engines to 
become inoperative. However, the remaining OMS engine is capable of 
completing the on-orbit phase of the mission. It is also capable of 
completing the de orbit mission requirements with the ACPS providing the 
necessary vehicle pitch control. If both OMS engines become inoperative, 
deorbit capability would be accomplished via the ACPS as an emergency 
mode of operation. 

The design criteria for the ACPS is FO/FS during the critical period 
of ESS/booster separation and during the periods in which the ESS will be 
near any manned orbiting vehicle. The ACPS contains single point hardware 
failures which could cause the loss of one or more ACPS thrusters; however, 
the guidance and control system will provide the necessary control of 
alternate thrusters to compensate for any attitude errors resulting from 
the inoperative thrusters. 

The electrical power and control systems will have FO/FS capability 
except for the instrumentation and communications subsystems. Specific 
areas or critical measurements provided by the instrumentation subsystem 
are redundant. The communications subsystem has several single-point 
failures which could result in serious rendezvous position errors and/or 
loss of deorbit capability. 

Additional analysis will be conducted during the subsequent study 
phase or during the design implementation phase to eliminate where possible 
the identified single point failures or minimize the possibility of their 
occurrence. 

3.2 FAILURE MODE ANALYSIS AND HARDWARE CRITICALITY 

Failure mode effect analyses (FMEA) have been conducted on all 
major ESS systems to increase system design reliability by identifying 
and eliminating, where possible, all first-order critical failure modes. 
During the design implementation phase or subsequent study efforts, 
detailed FMEA will be conducted for each system addition or change and 
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will also establish the hardware criticality categories. The effect analysis 
describes how equipment in the stage systems can fail and the resultant 
effects of the failure on the mission objectives. . . 

The FMEA will also establish the component criticality categories. 

The criticality of an item refers to the potential effect of its failure on the 
stage, mission, or personnel. The potential effect of the failure depends on 
how the equipment is used and its mode of failure. Hardware criticality 
determination will be based on the following definitions: 


Criticality 

Potential Effect of Failure 

I 

Loss of life of crew member(s) (ground or 
flight). Also includes safety and hazard warning 
systems for primary operating systems whose 
failure has potential of loss for any associated 
crew member* s life. 


Loss of vehicle 

1 

H 

Immediate (safe) mission flight termination. 


Loss of primary or secondary mission 
objectives 


Launch scrub or delay 


During the design implementation phase, failure mode cause analysis 
will be conducted by the suppliers for each new critical component in a 
stage system including the main propulsion system engines, the orbital 
maneuvering system engines, and the attitude control propulsion system 
thrusters. 

The purpose of the failure mode cause analysis is to obtain a high 
reliability standard through prehardware evaluation of potential failure 
causes of the hardware and concomitant preventive measures. The failure 
mode for each of these critical components will be examined for potential 
failure causes and the identification of design characteristics as to why 
these causes should not occur. Preventive design actions may be taken 
whenever design weaknesses are highlighted. 
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The ground rules under which the ESS reliability analysis including 
FMEA's were conducted -are as follows: 

1. Only first-order failure modes that could result in main or 
auxiliary propulsion failures and mission loss are included. 

2. Stage structural failure modes are not considered. 

3. Structural failure of primary and secondary structural items 
including rupture of lines and components are not considered. 

The following sections contain a discussion, by stage subsystems, of 
design and operating characteristics relative to failure modes and the 
overall achievement of goals established by the specified criteria. 

3.2.1 Main Propulsion Subsystem (MPS) 

The MPS incorporates a one engine -out capability for the payload 
configuration of a space tug and the RNS. The ESS MPS does not have the 
capability to complete the mission with the space station if one MPS engine 
is lost during separation from the shuttle booster, or during the first third 
of the ESS boost period. This capability does exist if the failure occurs 
during approximately the last two -thirds of the ESS boost. 

Several single-point failure modes in the MPS supporting subsystem 
would result in loss of both engines being started or continuing to operate 
which would result in loss of mission. Their occurrence while still mated 
to the shuttle booster would also jeopardize the shuttle booster and crew 
during the critical period of separation. (Safe ESS/booster demating with 
both main engines out is not assured at this time.) The failure modes that 
can cause this condition are identified as loss of stage tank pressure 
because of an open vent valve or propellant fill valve, and loss of propellant 
recirculation capability. 

After selection of the engine manufacturer, the MPS engine supplier 
failure mode cause analysis will be made to detail the various engine 
system components which would contribute to loss -of-engine failures. 

The vehicle electrical control system for the ESS main engines is 
composed of 115/2 00 volt, 400 Hz, three-phase power inverters; acquisition 
control test (ACT) units; power transfer switches; and power control 
switches. 

The vehicle engine control system will use two ACT units per engine, 
each powered by a sub-bus containing redundant batteries. This redundancy 
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provides for the possibility of two failures occurring without losing control 
of an engine. Redundant inverters supplying power to each engine will be 
controlled by two power transfer switches located in series. 

In addition, each engine (on the ESS) is controlled by an electronic 
controller which contains two digital computers for increased reliability. 

The system is designed so that any combination of two failures in any 
of the engine control hardware such as main dc buses, ac buses, ACT units, 
transfer switches, control switches, or engine computers would retain one 
engine operational. The system is also designed to have the capability to 
functionally check all of the redundancy aspects of the system and isolate 
failures to a single component. The engine has the capability to check its 
system and identify any failures to the vehicle main computer via the ACT 
unit/data bus system. In the event both power sources fail, the engine has 
the capability to shut down safely. 
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SINGLE POINT FAILURE MODE EFFECT ANALYSIS (FMEA) ASSOCIATED WITH 
THE POSSIBLE LOSS OF A MAIN PROPULSION SYSTEM 


MAIN PROPULSION SUBSYSTEM (MPS) 


Item 

Function 

Failure Mode 

Failure Effect 

MPS engine 

Two main engines are provided 
to boost the ESS with its pay- 
load into orbit. 

One engine fails 
to start (MPS 
engines are 
started while 
still mated to 
the shuttle 
booster) 

Loss of mission with space station 
payload. One engine -out capability 
exists for missions with lighter 
payloads (tug and RNS). Loss of 
one engine during the booster/, 

ESS separation phase does not.- 
present a hazard to the shuttle 
booster or crew. 




Loss of both engines while mated 
with the shuttle booster will 
require further analysis to deter- 
mine if separation can be accom- 
plished safely. 



One engine fails 
to continue 
r unning 

MDAC space station payload mis- 
sion cannot be successfully 
completed if engine failure occurs 
during approximately the first 
third of the ESS boost period. 





o 

Pressurization Subsystem (Main LO 2 and LHg Tanks) 

The ESS main propellant tank pressurization system utilizes the basic 
design associated with the S-II pr es sur ization system. Both LO 2 and LH2 
tank pressures are supplied from the main engines through orifices con- 
sidered passive components with no failure modes. Both L02 and LH2 
tanks are protected against overpres sur ization by two vent valves located in 
parallel, thus providing pressure relief redundancy. The most critical 
failure mode of the pressurization system is a single vent valve failing to 
remain closed. This condition would deplete tank pressure and cause loss 
of both engines, resulting in mission loss. Occurrence of this failure while 
the ESS is mated to the shuttle booster could also jeopardize the safety of 
the shuttle booster crew members; 

Loss of tank pressure may also lead to structural failure. However, 
these modes of failure are considered to have a low probability of occur- 
rence and have never been experienced during any S-XI stage flights. 

Electrical control for the ESS pressurization system consists of 
signals for the LO 2 and LH 2 tank venting and sensing of LO 2 and LH 2 tank 
pressures. All electrical control functions are completed prior to liftoff 
except one. Approximately 10 seconds after ESS main engine ignition, the 
low-pressure mode signal to the main tank propellant vent valves is 
initiated by the main engine computer. The signal is transmitted through 
redundant ACT units to stage redundant data buses. The information is 
then received by redundant ACT units, through redundant power switches, 
for control of the two vent valves on the LH 2 and LO 2 tanks, thus 
fulfilling FO/FS criteria. 

Prelaunch, ground checkout, and standby operations require FO/FS 
electrical control which is attained by double and triple redundant sensing 
and control hardware and interconnection of two ACT units with the 
appropriate solid-state power control switches. 
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SINGLE POINT FAILURE MODE EFFECT ANALYSIS (FMEA) ASSOCIATED WITH 
THE POSSIBLE LOSS OF A MAIN PROPULSION SYSTEM 


PRESSURIZATION SUBSYSTEM (MAIN LO2 AND LH 2 TANKS) 


Item 

Function 

Failure Mode 

Failure Effect 

Vent valve LO2 and LH2 
(two required per tank) 

Two vent valves per tank 
(LO2 and LH2) are pro- 
vided in parallel to pro- 
vide tank venting during 
propellant loading and 
also to vent excess 
ullage pressure following 
tanking and during flight., 
Valves are normally 
closed. 

One valve fails to 
remain .closed. 

Loss of tank pressure in 
either LO2 or LH2 system 
will result in loss of both 
MPS engines and loss of 
mission. 

Loss of both engines while 
mated to the shuttle 
requires further analysis 
to determine if separation 
can be accomplished 
s afe ly. 

This failure has a low 
probability of occurrence 
based on the present 
successful application of 
vent valves on the S-II 
program. 






LH^ Recirculation Subsystem 

The LH2 recirculation is accomplished by driving the engine low- 
pressure L.H2 pump with a small electric motor. This portion of the sub- 
system will be analyzed for failures by the engine supplier. The remainder 
of the system is composed of passive components, i. e. , lines and fittings, 
except the return valve which is mounted at the L.H 2 tank. This, valve is 
normally open. Valve failing in the closed position would interrupt LH2 
recirculation for both engines, resulting in loss of engine, start capability 
and loss of mission. Failure of the engine - mounted pump or electric 
motor would result in the loss of one engine to start. 

Valve Actuation Subsystem 

The ESS valve actuation system is basically the same as that used on 
the S-II stage. There are no first-order failure modes that would result in 
loss of an engine or mission. 

Engine (MPS) Servicing Subsystem 

Servicing systems required to provide purge, engine valve actuation, 
engine nozzle extension and retracting, and other needs have not been 
established sufficiently to warrant an analysis. To make a meaningful 
failure mode effect analysis , engine supplier designation and specific 
engine configuration and requirements are needed. Subsequent study phases 
will be concerned with this subsystem. 
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SINGLE POINT FAILURE MODE EFFECT ANALYSIS (FMEA) ASSOCIATED WITH 
THE POSSIBLE LOSS OF A MAIN PROPULSION ENGINE 


LH2 RECIRCULATION SUBSYSTEM 


Item. 

Function 

Failure Mode 

Failure Effect 

LH 2 recirculation 
return valve 

This normally open valve located 
near the LH 2 tank controls the 
return flow of LH 2 circulated 
through both engines. Valve re- 
mains open for recirculation and 
is closed at the time engines are 
started. Closed function is re- 
dundant to the engine -mounted 
fuel bleed valves. 

Valve fails to. 
remain open. 

Valve in closed position will 
terminate engine precon- 
ditioning and can prevent both 
engines from starting. Low 
probability of this failure 
occurring in that the valve is 
normally open and is 
pneumatically actuated 
closed. Valve is presently 
used in the S-H engine 
recirculation subsystem'. 

Loss of both engines will 
result in booster crew 
hazard during staging and 
loss of ESS mission. 




rv 



@ 

LC >2 Recirculation (Helium Injection) and Pogo Suppression Subsystems 

The helium injection system required for LO 2 recirculation is 
basically the same as the S-II system except one solenoid valve controls the 
flow of He rather than two. (Two were required to meet flow requirements 
on the S-II). The normally open valve failing closed or regulator failing 
closed would cut off He injection supply and prevent one or both engines from 
starting. Loss of both main engines during shuttle /ESS separation will 
result in mission loss and create a hazard to shuttle booster crew. 

Each engine recirculation system contains a normally open LO 2 
recirculation return valve which can prevent the engine from starting if the 
valve fails to remain in the open position. These failure conditions are 
considered to have a low probability of occurrence because of the successful 
service experienced on the S-II stages. 

Loss of pogo suppression capability is not a critical failure mode in 
itself unless its loss is determined to result in structural failure. There- 
fore, additional study of pogo effects and probability of occurrence is needed 
to determine criticality of the pogo suppression systfem. Failure of the LOg 
feedline accumulator bleed valve in the closed position would prevent filling 
the accumulator with LO 2 and may adversely affect engine start. This bleed 
valve i's the same as the recirculation return valves. 
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SINGLE POINT FAILURE MODE EFFECT ANALYSIS (FMEA.) ASSOCIATED WITH 
THE POSSIBLE LOSS OF A MAIN PROPULSION SYSTEM 


lo 2 RECIRCULATION 

(He) INJECTION AND POGO SUPPRESSION SUBSYSTEM 


Item 

Function 

Failure Mode 

Failure Effect 

Pressure regulator 

Reduces the high pressure 
He receiver system from 
3000 psi to 750 psi for He 
injection into the L0 2 re- 
circulation system and for 
the L0 2 feed line accumu- 
lator pogo suppression 
system. 

Fails closed 
(regulates low) 

Loss of sufficient He injection 
flow in the LOz recirculation 
system may result in failure to 
start main engines. Failure after 
main engine start would result in 
loss of pogo suppression system 
which could cause structural 
damage and loss of main engines 
and mis sion. 


- 

Fails open 

(regulates 

high) 

System overpressurization relief 
valve would open. This condition 
could cause He supply to become 
depleted prior to main engine 
shutdown. Loss of pogo suppres- 
sion would result. 

Solenoid valve 

Controls flow of He, from 
the regulated supply, to 
the L0 2 recirculation re- 
turn line. Valve is 
normally open and He in- 
jection is initiated prior . 
to liftoff. 

Valve fails to 
remain open. 

Loss of L0 2 recirculation capa- 
bility for both engines resulting 
in possible loss of engine start. 
Low probability as valve is 
normally open. 
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SINGLE POINT FAILURE MODE EFFECT ANALYSIS (FMEA) ASSOCIATED WITH 
THE POSSIBLE LOSS OF A MAIN PROPULSION SYSTEM (CONT) 


L 0 2 RECIRCULATION 

(He) INJECTION AND POGO SUPPRESSION SUBSYSTEM 


Item 

Function 

Failure Mode 

Failure Effect 

LO2 recirculation 
return valve 

A normally open valve which 
controls flow of recirculated 
propellant from the engine 
back into tank. One L 0 2 
valve is required per engine. 

Valve fails to 
remain open. 

Loss of LO2 recirculation capa- 
for one engine system. Possible 
loss of engine start capability. 

Low probability of failure as valve 
is normally open. Failure of L 0 2 
valve will also prevent proper 
willing of LO2 feedline accumula- 
tor with LO2. 

Valve , 

accumulator bleed 

A normally open valve which 
vents the accumulator to 
allow for proper filling of 
the accumulator. Bleed 
prevents G 0 2 forming prior 
to main engine start. 

Fails closed 

L 0 2 feedline accumulator will not 
be filled with LO2 resulting in GO2 
formation and possible loss of one 
engine -start capability. 




o 



Thrust Vector Control (TVC) 



The ESS thrust vector control (TVC) for the main engines incorporates 
a portion of the design and components proposed for the shuttle or biter 
vehicle. Basically the system is an S-II engine actuation system (EAS) scaled 
up to meet the requirements of the orbiter engines. 

NASA is currently evaluating the potential addition of an engine -driven 
accessory pad to the space shuttle engine. If approved, the ICD would be 
changed accordingly. The contractor has assumed this capability will be 
provided, and has described a hydraulic system based on this. In the event 
this capability is not provided, the type of system selected would be a 
pneumatically driven hydraulic system. 

Each main engine has its individual TVC system. The system consists 
of an engine (MPS) driven hydraulic pump and an electric motor -driven 
auxiliary pump. Both pumps supply hydraulic pressure to an accumulator 
reservoir manifold assembly (ARMA) which in turn supplies hydraulic pres- 
sure to two actuators. Both actuators are required to provide a pitch, roll, 
or yaw moment to the stage. 

The auxiliary pump supplies pressure before main engine start for 
engine valve control. It continues after start of engines and supplies 
hydraulic pressure in combination with the engine-driven pump, thus pro- 
viding redundancy for pump pressure supply at a reduced flow rate. The 
actuators and ARMA have no redundancy. Loss of hydraulic pressure during 
flight will result in the actuators locking up, thus preventing shutdown of 
that engine. Flight control will be provided by the remaining engine and the 
ACPS. The system has FO capability with failure in this mode. A failure 
of the TVC resulting in an engine gimballing hardover will require shutdown 
of that engine. A failure that causes shutdown of one main engine will result 
in loss of the primary mission in those situations where the ESS does not 
have one main engine-out capability. Therefore, the TVC does not meet 
FO-FS criteria in all cases. 

The electrical control of the TVC provides FO-FS capability and is 
provided from the guidance, navigation, and control (GN&C) system which 
incorporates redundant acquisition, control, and test (ACT) units supplying 
excitation to each actuator servo -valve. 
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Propellant Feed Subsystem 

The propellant feed subsystem consists of the 1,02 and LH2 tanking 
system and the propellant delivery system to the MPS engines. The basic 
system for propellant loading utilizes the S-II propellant fill and drain valves. 
A fill valve failing to remain closed could spill propellant. on sections of the 
booster and would also result in loss of main tank pressure which would 
cause the failure of both engines to start or to maintain operation. These 
valves are normally closed (spring loaded) and are considered to have a low 
probability of valve failing to remain closed because of the extensive valve 
qualification testing and the successful S-II stage static firings and flight 
operations. 

The propellant supply to the engines is through normally open pre- 
valves as on the S-II pre sent design. However, the prevalves and feed ducts 
are 13 inches in diameter on the ESS as compared to the 8 -inch diameter on 
the S-II. The pre valves have no functional failures with a mission effect as 
they are not required to operate during recirculation system operation as on 
the S-II stage. 

These valves will be developed for the shuttle orbiter program and will 
contain actuation pressure redundancy to meet the requirements of FO/FS. 
The critical failure mode associated with the prevalves is inadvertent closing 
of the valve because of actuation or valve mechanism failure causing flow 
restriction. This failure condition can also be considered to be a low proba- 
bility of failure based on previous program experience with similar 
installations. 
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SINGLE POINT FAILURE MODE EFFECT ANALYSIS (FMEA) ASSOCIATED WITH 
THE POSSIBLE LOSS OF A MAIN PROPULSION ENGINE 


PROPELLANT FEED SUBSYSTEM 


Item 

Function 

Failure Mode 

Failure Effect 

Main tank 
fill valve 

(lo 2> 

lh 2 ) 

Provides a means of filling 
the stage tanks (LO 2 and 
LH 2 ). Valves are closed 
following tanking and are 
required to remain closed 
during flight. Two valves 
are required per stage. 

Fails to remain 
closed in flight. 

Valve failing open would create hazard 
from overboarding of propellant (L0 2 or 
LH 2 ). Loss of tank pressure and engine 
NPSP would result in loss of the main 
engine start capability or ability to con- 
tinue to operate. Loss of both engines 
results in loss of mission. Loss of both 
engines during separation from the shuttle 
booster requires further analysis. Proba- 
bility of valve failing open is low as valve 
is normally spring loaded closed. 






Subsystem Electrical Control 

The electrical control subsystem provides the power and control of 
mechanical components in the propellant feed, helium injection and pogo sup- 
pression, LH 2 recirculation, and valve actuation subsystems. The system 
is required to be fail operational-fail safe during shuttle boost and separation. 
Thus, two or three electrical control paths are provided, depending on a func- 
tion failing safe or unsafe when the control power is lost. 

t 

System reliability will be assured by utilizing redundant components 
and measurements and selection of proven hardware. 

Switching signals are generated by the on-board computer and operate 
through triple redundant acquisition, .control and test (ACT) units, and the 
data bus. 

System /component operations will be verified for a set number of 
samples and then transmitted via the ESS computer /data bus and comparison 
failure of two or more indicators will switch to an alternate electrical con- 
trol path. By applying these redundancy techniques, a high reliability is 
maintained throughout the electrical control for all of the subsystems. 

Safing System 

It has been a design objective that the required safing system not 
degrade the primary mission reliability and that failure of a single critical 
component would not cause the safing system to become inoperative. 

The ESS safing system will consist of safing provisions for the main 
propellant tanks. Both the LO 2 and LH 2 tanks will utilize safing systems 
similar to the S-II-13 terminal stage which consists of redundant ordnance 
actuated vent valves. The electrical control system for activating the safing 
system tank vent valves has changed from the payload separation initiated ■ 
timers and relay control logic to the ESS computer /data bus /acquisition, 
control system with solid-state power control switches. 

The critical failure mode associated with the proposed safing system is 
premature safing which would result in the inability of the ESS to complete the 
mission objectives. Low probability for this type of failure occurring has 
been achieved by designing the safing system to become activated by the ESS 
computer /data bus /acquisition control system. The typical electrical control 
circuit used for safing will utilize independent solid-state power control 
switches (PCS) for arming and triggering the individual EBW firing units. 

The electrical safing circuitry and the ordnance /vent valve system con- 
tain parallel redundant components which preclude the possibility of a single 
failure causing the safing system to become inoperative. 
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3.E.2 Auxiliary Propulsion Subsystem (APS) 

The auxiliary propulsion system (APS) consists of the orbit maneuvering 
system (OMS) and the attitude control propulsion system (ACPS) utilizing com- 
mon LH2 and LO 2 propellant tanks. The two OMS engines supply the neces- 
sary thrust for achieving final orbit, rendezvous, and for deorbiting the stage. 
The ACPS consists of 14 thrusters for maintaining vehicle attitude during 
orbital periods, for supplying braking thrust for rendezvous, and for provid- 
ing vehicle roll control during the condition of one main engine out. The 
proposed auxiliary propulsion system will utilize the system design/component 
concepts used for the shuttle orbiter vehicle. The basic reliability of these 
system concepts is retained to achieve maximum functional integrity. 

Single point failures in the APS which would affect both the OMS and 
ACPS are primarily associated with excessive propellant utilization caused 
either by propellant leakages or excessive ACPS operation. If the ACPS 
thrust chamber feed valves which control the GO 2 and GH2 to the individual 
thrusters do not completely close when required, the loss of APS propellant 
would result. This condition could also create excessive demands on the 
system to maintain vehicle attitude resulting from the low thrust developed 
by the propellant gas leaking through the thruster. This condition could 
result in premature depletion of APS propellant if excessive gas leakages are 
present, the condition occurs early in the life of the mission, and the condition 
is not detected and the bank of thrusters isolated. 

The vent valve provides control of gas exhausting from the heat 
exchanger /turbo -pump gas generators through either the propulsive vent or 
the nonpr opulsive vent. If one of the two valves used per stage fails in the 
propulsive vent position, the constant thrust developed would cause demands 
on the ACPS to maintain vehicle attitude. 

These conditions will require further analysis during subsequent study 
efforts or during the design implementation phase to determine the proba- 
bility of failure and to ascertain if the system reliability could be improved 
s ignif ic antly . 

Attitude Control Propulsion Subsystem (ACPS) 

The ACPS is required to provide vehicle roll control during the critical 
period of booster separation with one main ESS engine out and pitch control 
during the deorbit phase of the mission with one OMS engine inoperative. 

Single -point failures associated with the ACPS in which one or more 
thrusters could become inoperative are identified in the failure mode effects 
analysis. 
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The ACPS is also designed to provide necessary pitch control during 
the deorbiting phase of the mission with only a single OMS engine operating. 
During this phase of control, an operational loss of any pitch thruster would 
cause the vehicle to initiate a roll which can be controlled by the guidance 
system switching control of the thrusters; the pitch thrusters would be 
changed to supply the necessary thrust required for roll control and vice 
versa. 

The electrical control system for the ACPS will basically consist of the 
same system used for control of the OMS engines. The system'uses attitude 
control driver units (ACDU) for accepting information from the guidance sys- 
tem and for controlling the appropriate thruster propellant valves and igniters. 
System reliability is assured by the use of triple redundant components within 
each ACDU. The system's control computer will have the capability to detect 
the failure of any thruster and to command other thrusters that have the capa- 
bility to supply the necessary vehicle control moments. 
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ATTITUDE CONTROL PROPULSION SYSTEM (ACPS) FAILURE MODE EFFECTS 
ANALYSIS (FMEA) SINGLE POINT FAILURES ASSOCIATED WITH 
THE LOSS OF AN ATTITUDE CONTROL THRUSTER 


Item 

De scr iption 

Failure Mode 

Failure Effect 

ACPS thrust 
chamber feed 
valves (0 2 
and H 2 ) 

Controls GO 2 and GH 2 supply to the 
individual thrusters. Valves are 
normally closed with 2 valves required 
per thruster. Total of 14 valves are 
used per ACPS module (7 thrusters) 
with a total stage requirement of 
28 valves (14 thrusters). 

Valve fails to 
remain open 
when required. 

That particular thruster would become inopera- 
tive resulting in the guidance system providing 
the necessary control of alternate thrusters to 
compensate for the inoperative thruster. 


Valve fails to 
close when 
required 
(excessive 
leakage). 

Loss of 0 2 or H 2 gas could result in eventual 
loss of propellant; low thrust mode of thruster 
would also cause excessive demands on system 
to maintain vehicle attitude resulting in the 
rapid depletion of propellant. Would have to 
shut down that bank of thrusters to avoid 
excessive loss of propellant. 

ACPS thruster 
bank pressure 
regulators 
(0 2 and H 2 ) 

Regulates 0 2 and H 2 pressure to the 
ACPS thrusters. Two regulators (02 
and H 2 ) are used for each bank of 
thrusters. Total of three H 2 and 
three 0 2 regulators are used per 
thruster module with a total of 12 
regulators required per stage. 

Regulates 0 2 or 
H 2 pressure 
high or low 

Regulator system would be shut down resulting 
in the complete loss of that bank of thrusters.. 
With the loss of any bank of thrusters, the 
guidance system would provide the necessary 
control of alternate thrusters to compensate for 
any attitude errors resulting from the inopera- 
tive thrusters. 

ACPS thruster 
bank pres sure 
regulator iso- 
lation valves 

{0 2 and H 2 ) 

Isolates failed thruster bank /regulator . 
Valves are normally open with two 
located in series for each pressure 
regulator. A total of 12 valves are 
used per module with 24 valves 
required per stage. 

Valve fails to 
remain open. 

Loss of that bank of thrusters controlled by this 
valve would result in the conditions noted 
above. Low probability of failure since valves 
are normally open. 




Orbital Maneuvering Subsystem (OMS) 

The OMS is required to meet the desired system requirements criteria 
FO/FS established by the deorbit requirements of ensuring that the vehicle 
flight path is within the permissible pre-established bounds. Crew surviv- 
ability is not involved. 

OMS single-point failures which would cause the loss of an engine are 
identified in the failure mode effects analysis. ? 

The electrical control system for the OMS engines will interface with 
the GN&C through the data bus /engine control driver units. Each engine will 
be controlled by one control driver unit which contains circuitry to control 
the engine's propellant feed valves and provide ignition excitation. Each 
control driver unit contains dual integral redundancy which provides suffi- 
cient reliability to ensure against a single failure that could cause the loss of 
an OMS engine. A dual failure within one engine's control driver unit would 
enable the OMS system to meet the requirements of FO/FS by the successful 
operation of the remaining engine. 

The OMS engine actuation system provides hydraulic power and actua- 
tion forces that gimbal the engines to provide vehicle directional control 
during orbit operations. Each engine will contain a completely independent 
hydraulic system similar to the engine's independent hydraulic system 
successfully used on the S-II stage. Hydraulic power will be supplied by an 
electrically-driven pump for each engine system. The failure of an 
electrically-driven hydraulic pump would cause the engine actuation system 
to become inoperative resulting in lockup of the ser voactuator s and loss of 
that engine' s gimballing system. This failure mode would cause demands on 
the ACPS to maintain proper vehicle attitude for the deorbit phase of the 
mission. 

To ensure a high reliability for the electrical control system, the thrust 
vector control electronics and hydraulic pump electrical power are redundant 
for each engine's gimballing system. 
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THE LOSS OF AN ATTITUDE CONTROL THRUSTER ORBITING 
MANEUVERING SYSTEM (OMS ENGINE) FAILURE MODE 
EFFECTS ANALYSIS (FMEA) SINGLE POINT FAILURES 
ASSOCIATED WITH THE LOSS OF AN OMS ENGINE 


Item 

Description 

Failure Mode 

. Failure Effect 

OMS engine 
thrust chamber 
feed valve (02 
and H2) 

Controls propellant/ oxidizer flow into OMS engine thrust 
chamber. Valves are normally closed — two valves per 
engine {O2 and H2), four valves per stage. 

Valve fails to 
open 

OMS engine will fail to start 

Valve fails to 
close (exces- 
sive leakage) 

Excessive leakage of LO2 or LH2 through the failed 
open valve would result in eventual loss of propellant 
which could result in complete loss of OMS engines 
and ACPS. 

Turbopump 
(02 and H2) 

Gas generator driven turbopumps which are common to 
either orbit maneuvering or attitude control operating 
modes. The turbopumps supply high-pressure LH2 and 
LO2 to the OMS engine. Total of four pumps are utilized 
per stage. 

Inoperative 
pump /turbine 

Loss of OMS engine 

Turbopump gas 
generator (O2 
and H2) 

Gas generator supplies the necessary gases for operating 
the turbine-driven turbopumps noted above. Two gas 
generators are required. for each OMS engine. Total of 
four gas generators are utilized fOT turbopump operation 
to support the operation of the OMS engines. 

Inoperative 

generator 

Causes turbopump to become inoperative resulting in 
loss of that OMS engine. 

Turbopump gas 
generator pro- 
pellant shutoff 
valves {O2 and 

Hz) 

Controls the supply of O2 and H2 to the gas generators. 
Valves are normally closed. Two valves are used for 
each gas generator with a total of eight valves utilized 
per stage. 

Valve fails to 
open or fails 
closed after 
being open. 

The gas generator will fail to operate resulting in the 
turbopump being inoperative and the respective OMS 
engine becoming inoperative. 

Valve fails to 
close (exces- 
sive leakage) 

Excessive leakage of LO2 or LH2 through the failed 
open valve would result in eventual loss of propellant 
which could result in complete loss of OMS engines 
and ACPS. 

Selector valve 
(LQ 2 and LH 2 ) 
OMS engine or 
ACPS condi- 
tioning loop 

Controls propellant flow to either OMS engine or ACPS 
conditioning loop — two valves per engine (L02/LH2). 
four valves per stage. 

Valve fails to 
allow flow to 
OMS engine 

Loss of OMS engine 

Turbopump gas 
generator 02 
and H2 pres - 
sure regulator 

Regulates O2 and H2 gas pressure 'to the gas generator. 
Two regulators are used for each OMS engine with a 
total of four regulators required per stage. 

Regulates 
high or low. 

Potential hazard from over/under pressure. Time 
dependent fire /explosion due to improper mixture 
ratio. Both gas generators will become inoperative* 
resulting in loss of the turbopump and the respective 
OMS engine. 

Turbopump gas 
generator O2 
and H2 isola- 
tion valves 

Gas generator isolation valves are used to isolate a 
failed gas generator. Two valves are located in series 
upstream of each pressure O2 and H2 gas pressure 
regulator. Valves are normally open Four valves are 
required for each OMS engine with a total of eight 
valves utilized per stage. 

LO2 or LH2 
valve fails to 
remain open. 

Both gas generators used for driving the LO2 and LH 2 
turbopumps would become inoperative resulting in the 
loss of an OMS engine. 

Low probability of failure since valves are designed to 
be normally open. 

L02/LH2 
supply 
pre valves 

Controls to the supply of LO2 and LH2 to the OMS 
engines. Valves are normally open and arc located 
two in series for each turbopump/OMS engine. Total 
of four valves are utilized per OMS engine with eight 
required per stage. 

LO2 or LH2 
valve fails to 
remain open. 

Loss of OMS engine. 

Low probability of failure since valves are normally open. 

Propuls ive 
vent valve 

Provides control of gas from the heat exchanger/ 
turbopump gas generators through either the propulsive 
vent or the nonpropulsive vent. Valve is positioned to 
the propulsive vent position during OMS engine firing. 
Total of two valves utilizes per stage. 

Valve fails m 
the propul- 
sive vent 
pos ition 

Constant thrust from vent would cause demands on ACPS 
to maintain vehicle attitude resulting in increased pro- 
pellant consumption. 
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3.2.3 Avionics Subsystems 




Guidance, Navigation, and Control 

The guidance, navigation," and control (GN&C) system will be designed 
to FO/FS criteria for low-orbit insertion, orbital transfer, and rendezvous 
goals of an ESS mission. Guidance requirements will be fulfilled by triple 
redundant inertial measurement units (IMU), nine vibrating wire rate sensors 
{three per axis), and triple redundant central computing units (GPU) with ‘ 
quadruple redundant memory units. Navigation updates will take place 
through the data uplink (two units) of the communications system and CPU. 
Control will be accomplished by CPU signals to triple redundant driver units 
of the attitude control propulsion system (ACPS), the orbital 'maneuvering 
system (OMS), and the main engine and OMS gimbal actuators. 

IMU electronics are contained in two line replaceable units (LRU), the 
power supply, and the platform. The internal electronics of these LRU’s, 
such as gyros, synchros, resolvers, and accelerometers, are not redundant. 
Each IMU and its power supply interface through an acquisition, control, and 
test unit to the data bus to receive update signals and provide position data. 
Detection of failure by the CPU will lead to removal of that particular unit 
from the system. 

Thrust vector control (TYC) gimbal electronics are redundant to each 
engine, thus providing FO/FS for the TVC electronics requirement. This is 
based on one -engine- out capability. The electronics for control of the driver 
units for the OMS engines and the ACPS are redundant and, based upon 
engine-out capability, more than satisfy FO/FS mission requirements. 


Data and Control Management (DCM) Subsystem 

The DCM subsystem fulfills all of the major control and data manage- 
ment requirements for the ESS. These requirements fall 'in the four broad 
categories of control of GN&C, vehicle sequencing, 'redundancy management, 
and data management. 

The DCM function is realized through two major classes of hardware, 
the central processing unit (CPU) and the acquisition, control, and test units • 
(ACT), which is an interfacing unit, plus appropriate computer software 
programs . 

The DCM will accept GN&C position measurements, process them 
through the computer, and route appropriate gimbal actuator and engine 
driver signals to maintain orientation and position of the ESS to schedule. 

The DCM will also accept updata through the communications subsystem and 
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route and process such, data in the required manner. Processing is 
performed independently in the "prime" and "check" computers and results 
are compared before action is taken. 

Vehicle sequencing and self-check is carried out by the DCM per 
established software programs stored in the computer memory. Fault 
detection leads to corrective action programs by the CPU which isolates 
defective units and switches them out of the functional loop while switching a 
good replacement unit into the loop. Vehicle event sequencing proceeds per 
program unless changed by an update command or a fault detection. Alterna- 
tive action programs are then selected. 

The data management function of the DCM will transmit, upon request, 
the status of all units in the ESS as determined in the periodic checks. It also 
selects the data bus and unit addresses for command and status information. 

FO/FS redundancy is provided in all major units, i.e. , computers, 
memories, ACT, wire harnesses, down to cross -strapping of LRU's to a 
min imum of two ACT's. Partial internal redundancy is provided in some 
units such as the ACT's and some noncritical functions. Most hardware of 
the DCM system is derived from the space shuttle DCM hardware and will be 
qualified and tested to space shuttle standards. Those items which are 
unique to the ESS will be provided to a FO/FS redundancy level for critical 
mission and safety functions. Remaining hardware will be qualified to the 
Saturn- Apollo level of reliability. The coverage factor (ability to recover 
from a failure) of the DCM self-check ability is required to be greater than 
99. 5 percent. 

Thus, the ESS DCM subsystem is a complex set of hardware and soft- 
ware that performs many sophisticated functions in the assurance that the 
ESS has a fail operational/fail safe capability for the safety of the booster 
crew in the launch, boost, and separation mission phases and the FO/FS 
capability is retained for the deorbit phase of the mission. The DCM sub- 
system keeps tabs on all major critical units, including its own, and switches 
redundant units into functional loops when required. DCM FO/FS capability 
has been achieved. 

Communications Subsystem 

The communications subsystem transmits updata information for com- 
mand and GN&C, downdata for telemetry of ESS instrumentation, and range 
safety commands. Certain hardware items have been included as redundant 
units where the reliability was considered inadequate. 

In the present concept, single -point failures exist in the communications 
link, mainly in the switching units, and will not satisfy the FO/FS criteria. 
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Loss of downdata is not critical; however, loss of the updata link may 
preclude ranging data and rendezvous commands from reaching the ESS 
computer which could result in serious position errors. In addition, retro- 
fire commands for deorbiting may be lost, resulting in uncontrolled reentry 
of the ESS upon orbit decay. 

The communications subsystem has been constructed of Apollo-Saturn 
hardware and will contain a high confidence factor in maintaining operational 
reliability. 

Electrical Power and Distribution Subsystem 

The electrical power and distribution subsystem is designed to meet 
the requirements of FO/FS. The 28 vdc main power system consists of three 
separate battery sources which provide FO/FS system capability. Two out of 
the three sources will provide sufficient power for the entire mission. In the 
event two sources are lost, the third source will carry the load sufficiently to 
a safe condition. Within each power source there are three batteries. Assum 
ing equal distribution of loads, two of the three batteries in each source would 
provide sufficient power. Therefore, each of the sources could lose on batter 
or one source fail completely without affecting the main power system opera- 
tion for the total mission. 

In the ESS ac power system, two power sources for each engine will be 
incorporated. Each source is capable of carrying the load for that engine, ha 
the event both sources fail, the ESS stage has one main engine -out capability 
for RNS and tug payloads, and after approximately 100 seconds of ESS boost 
burn for the MDAC payload. 

Propellant Management Subsystem 

The propellant management subsystem proposed for the ESS is basically 
the same as that used for the S-II stage. The main difference is in the capaci 
tance sensor electronics which is much less complex and therefore should be 
more reliable than the propellant utilization computer used for the S-II stage. 

The level monitor system is for loading and indication only and is not a 
critical system. However, the system for both the main tanks and the APS 
tanks have incorporated redundancy by utilizing a capacitance probe for analog 
and point sensors for discrete level monitoring. 

The propellant depletion cutoff system is basically the same as that, usee 
for S-II. The two critical failure modes for the main engines are a premature 
engine cutoff or a failure to cut off the engine. To reduce probability of a pre- 
mature cutoff, voting logic is incorporated in the system requiring at least 
two propellant depletion signals; in addition, the point sensor controllers are 
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designed to give a wet indication in the event of a failure. For the main 
engines the propellant depletion cutoff is a backup system to the velocity 
cutoff system. 

The APS tank's depletion OMS engine cutoff system also contains a point 
sensor voting logic system. 

Ins trumentation 

The instrumentation system proposed for ESS utilizes a standard system 
that has been used on previous flight vehicles. Proven hardware used on the 
S-II program plus state-of-the-art hardware and hardware developed for the 
shuttle program will be used wherever practical. Wherever feasible, meas- 
urements will be converted to digital to obtain higher precision and accuracy. 

Since the instrumentation system is primarily a monitoring system, 
redundancy has not been incorporated throughout; however, measurements 
that are critical to the operation of the vehicle or safety of the crew will be 
redundant. 

Avionics Equipment and Environmental Control 

To assure maximum performance and reliability, the equipment con- 
tainers will be installed on the stage in areas which present the most ideal 
thermal and dynamic environment. System reliability is also enhanced by 
locating the containers to take advantage of the stage orientation during orbit, 
which eliminates the necessity for an equipment cooling system. 

To meet the FO/FS requirements for the control of container tempera- 
tures, the heater and control systems for each container will have a dual 
element heater and three controllers. Each heater element' will be controlled 
by two functionally independent thermostatic sensors and a solid-state control 
switch. The third control switch with its associated thermostatic sensor will 
be used as an emergency high-temperature safety cutoff switch. 

The electrical heater and control system has been designed to eliminate 
any single point failures. 

Avionics Container Separation 

The avionics container separation system used for retrieving costly 
equipment operates on the same electrical /ordnance system principle as the 
ESS/payload separation system and utilizes identical components. These 
components have been qualified and utilized on both Apollo and Saturn sys- 
tems; therefore, no development is required. 
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The critical failure mode associated with this system is the possibility 
of inadvertent system operation which would result in the loss of critical 
avionics and prevent the successful completion of the mission. 

To prevent an inadvertent command or signal from activating the dis- 
persion system, the system is designed to operate with two commands, the 
arm and separate commands which have to be received in the correct 
sequence for the separation system to be activated. 

Inadvertent system operation caused by auto -ignition of the ordnance 
devices is another failure mode which has been considered on the existing 
S-II systems to be extremely remote because of the physical stimulus of high 
temperature or impact that is required to enable detonation to occur. 

All components of this system have demonstrated very high reliability 
in test and operations throughout the space program. 

ESS/Fayload Separation System 

The separation system is designed so that single -point failures in the 
electrical control and ordnance systems will not cause a failure of the payload 
to separate from the ESS vehicle. It has also been a design objective to pre- 
vent the possibility of an inadvertent premature separation. 

The separation system consists of an ordnance system similar to the 
highly reliable ordnance system used on the S-II/S-IVB separation system. 

The electrical control for the ESS/payload separation system will be accom- 
plished via the ESS computer /data bus /acquisition control system. 

The critical failure modes associated with the ESS/payload separation 
system are the inability to separate the payload when required and premature 
separation. 

To ensure successful operation of the separation system, two completely 
independent and redundant exploding bridge wire (EBW) firing units and associ- 
ated ordnance devices are utilized. The electrical control of the separation 
system is also designed to ensure satisfactory operation by providing three 
separate 28-vdc power buses which will supply power for the separation sys- 
tem ACT units, solid-state power control switches, and EBW firing units. 

Each. EBW firing unit will be powered from a separate bus with the third bus 
used as a redundant source of power for both EBW firing units. The electrical 
control system also contains three ACT units with two units controlling power 
control switches for arming and triggering their respective EBW firing units 
and the third ACT unit being completely redundant in arming and triggering 
both EBW firing units through the power control switches. 
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To prevent the possibility of inadvertent power application activating 
the system prematurely, individual solid-state control switches for arming 
and triggering each EBW firing unit are used. In addition, twq failures are 
necessary in any one of the solid-state power control switches to inadvertently 
supply an output to the EBW firing unit. 

The existing S-II separation system or dnance- devices will be used in 
the payload separation system. Inadvertent operation or an ordnance device 
caused by auto-ignition has been considered on the existing S-II systems to 
be extremely remote because of the physical stimulus of high temperature 
or impact that is required to enable detonation to .occur. 

Propellant Dispersion System 

The propellant dispersion system proposed for the ESS will be- identical 
to the system presently used on the S-II stages except that dispersion range 
safety commands, if required, would not be employed until safe separation 
from the booster has been achieved. 

Failure to disperse propellant on command is not considered a mission 
failure because mission failure will be imminent before the propellant disper- 
sion command is given. The critical failure mode associated with this .system 
is the possibility of inadvertent system operation- which would result in the 
destruction of the stage along with the shuttle booster if attached or in the 
vicinity of the stage. 

To prevent an .inadvertent command or signal from activating the dis- 
persion system, the system is designed to operate with two- commands, the 
arm and dispersion commands, which have to be received in the correct time 
sequence for the dispersion system to be activated. 

L 

Inadvertent system operation caused by auto -ignition of the ordnance 
devices is another failure mode which has been considered on the existing S-II 
systems to be extremely remote because of the physical stimulus of high tem- 
perature or impact required to enable detonation to occur. 

3.3 MAINTAINABILITY 

Maintainability is defined as the design characteristics that makes 
possible the preservation or restoration of a functional element to its opera- 
tional state with a minimum expenditure of time, personnel skills, and 
logistics resources, under planned maintenance environment. Maintainability 
characteristics will be included among the first design considerations for 
developing a hardware system. These characteristics include, but are not 
limited to, accessibility, serviceability, repair ability, commonality. 
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standardization, interchangeability, component mounting, lifting and attach 
points, and related operational flexibility. 

The maintainability program will support the ESS systems, subsystems, 
and support equipment to the component level to provide standards and charac- 
teristics which effectively support the maintenance environment during the 
pre -operational and operational phases. This program will provide a system- 
atic method to promote the feasibility of turnaround maintenance activities as 
allocated by program operational requirements, minimize maintenance man- 
hours and subsequent training requirements, and increase vehicle and support 
equipment availability with resultant reduction in quantitative hardware 
requirements. The system will provide the criteria, methods, controls, and 
verification for maintainability to assure compatibility with program opera- 
tional requirements. 

3.4 MANUFACTURABILITY 

The manufacturing processes and techniques necessary for the- assembly 
and checkout of the expendable second stage have been developed and proven 
on the S-II and other NR programs, 

The structural commonality existing between the ESS and the S-II per- 
mits utilization of existing capability and experience available at previous 
S-II suppliers and subcontractors, in conjunction with the NR shops. Present 
tooling will be utilized for subassembly, assembly, and checkout except for 
isolated areas such as the thrust structure, which will require new tooling. 
The integrated avionics systems, developed through the resources of the 
Avionics Systems Integrated Laboratory (ASIL), does not present a problem 
for systems installations and checkout. The fabrication and installation of 
the erosion barrier and ablative materials was analyzed during the S-II 
INT-21 study program. Full-scale models of the erosion barrier were suc- 
cessfully manufactured and smaller sizes were tested, utilizing existing 
manufacturing techniques and processes which are readily implementable. 

All areas of the ESS vehicle have been thoroughly assessed and are 
considered to be within the state of the art. 
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4.0 TRANSPORTATION - SEAL BEACH TO KSC 


The use of the proposed space shuttle static firing fixture at KSC will 
eliminate the requirement to transport the qualification test stages to the 
Mississippi Test Facility which existed with the S-II. The ESS stages will be 
delivered directly to KSC, with the first two undergoing static firing tests. 

The stages will be moved from the NASA Seal Beach facility to the Seal 
Beach Naval Weapons Station loading dock by means of existing S-II trans- 
porters and a bailed prime mover, and there loaded onto an AKD-type ship 
such as the Point Barrow used during the Apollo program, for shipment to 
KSC. The existing turning basin and unloading dock facility at KSC will be 
used to unload the stages. 
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APPENDIX B. ORBIT MANEUVERING SUBSYSTEM TRADE STUDY 


At the conclusion of the ESS Phase A study, lunar module descent 
engines (LMDE) were selected for the orbit maneuvering subsystem. The 
LMDE was the winner in a trade study over RL-10 engines fed from the main 
propellant tanks and J-2 engines operating in a low-thrust mode. J-2 low 
thrust was considered only for an ESS utilizing J-2 engines for main propul- 
sion. The LMDE was the winner because of lower cost and the high boiloff 
penalty associated with maintaining propellants in the main tanks for 
24 hours. 

Another tradeoff was conducted at the initiation of Phase B as two other 
options were now available: 

1. The space shuttle orbiter engines had been selected over J-2 
engines for main propulsion. This dictated the use of a new thrust 
cone and allowed adequate space for separate cryogenic tankage 
for the OMS. With the basic S-II thrust cone with J-2 engines 
there is not enough space for separate cryogenic tankage. 

2. The space shuttle baseline recommends development of a 10,000-lb 
thrust OMS engine. The engine satisfies ESS requirements for 
orbit maneuvering. 

The trade study was performed with three options: 

1. LMDE (Phase A Baseline) 

2. RL-10 engines with separate tankage 

3. Space shuttle orbiter OMS engine with separate tankage 

The tradeoff was made based on cost and performance. The space 
shuttle orbiter OMS engine was the trade study winner. It showed both lower 
cost and higher performance than the RL-10 and LMDE. The trade table is 
presented by Table B-l. The primary reasons for the lower cost and 
improved performance with the space shuttle orbiter OMS engine are: 

1. The Space shuttle program will develop the engine. With the 

RL-10 engine the ESS program would have to pay for significant 
development costs as the RL-10 would have to be upgraded for 
the ESS. With the LMDE the ESS would have to pay startup costs 
as the ESS would be the sole user of the engine. 
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The space shuttle OMS engine has a slightly higher I than the 
RL-10 and a significantly higher I S p than the LMDE, 

The space shuttle OMS engine has been selected for the ESS OMS 
and is included in all ESS performance and design data. 

It is noted that should the Space Shuttle Program change the engine 
for orbit maneuvering, it is likely that the same engine would be the choice 
for the ESS. The aforementioned development/startup cost rationale 
would apply. 


Table B-l. 


Cost/Performance Consideration in Design — 
OMS Trade (Millions of Dollars) 
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ENGINE ACTUATION TRADE STUDY 


A tradeoff analysis was performed to select the type of engine actua- 
tion subsystem to be utilized on the ESS. The candidates were: 

1. Engine shaft drive - hydraulic system 

2. Electrical drive - hydraulic system 

3. Pneumatic drive - pneumatic system 

4. Pneumatic drive - hydraulic system 

5. Auxiliary power unit drive - hydraulic system 


The trade table is shown by Table A-l. The engine shaft drive was 
the trade winner and has been recommended for the ESS baseline. It should 
be noted that this affects the shuttle engine ICD 13MI5000B as the SSE does 
not currently have an accessory drive shaft. In the event the engine shaft 
drive is not approved for incorporation, a pneumatic driven hydraulic 
system would be the alternative. 


Table A-l. Cost/Performance Consideration in Design 
EAS Selection (Millions of Dollars) 
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APPENDIX C. DEORBIT TRADE STUDY 


Table C-l presents the ESS deorbit cost comparison for four candidate 
systems. The candidate systems traded were the ESS OMS, separate systerr 


Table C-l. ESS Deorbit Cost Comparison 
{Millions of Dollars - 20 stages), AV = 550 fps 


Candidate 


Cost 

ESS 

Separate System 

Separate System 

Shuttle 

Element 

OMS 

Orbiter Delivered 

on ESS 

Orbiter 


$R 

$NR 

$R 

$NR 

$R 

$NR 


Propellant 

Negl 

- 

- 

- 

- 

- 

Deorbit loads 
exceed present 

Payload 







orbiter dock- 

penalty* 

13. 4 

" 

1.2 


37.2 


ing interface 
load carrying 

Engines 

12. 3 

0.5 

14. 0 

1 . 1 

14. 0 

1 . 1 

capability. 

Structure 

- 

- 

4. 0 

1 . 1 

4. 0 

1 . 1 


Orbit 

delivery* 

- 

i 

38.4 

- 

- 

- 

■ 

Subtotal 

25. 7 

- 

57. 6 

2.2 

55. 2 

2.2 


Total 

26 

2 

59. 

8 

57 

.4 



*Based on $200/lb 


Conclusion: ESS orbit maneuvering system will be used for deorbit. 


or biter- delivered, separate system on ESS and the shuttle orbiter. The 
ESS OMS was concluded to be the most cost effective for deorbit. A 
deorbit sequence utilizing the shuttle orbiter is shown in Figure C-l. 
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The ESS OMS is a system available on the vehicle and results in the 
lowest total cost, 26.2 million .dollar s based on 20 stages. The major cost 
elements are the payload penalty resulting from the 3365 pounds of 
additional propellant that must be loaded for the deorbit burn and the loss 
of the OMS thrust chambers which cannot be recovered. No structural 
changes are required, and the avionics changes necessary are mininal. 

The separate system orbiter-delivered consists of 12 solid propellant 
motors mounted in either the forward or aft skirt. The total cost of this 
system would be 59. 8 million dollars {20 stages), primarily because of the 
cost (38.4 million) associated with delivery of {he solid motors weighing 
9600 pounds and the cost of the motors (14. 0 million). The orbit installa- 
tion associated with this system would be an undesirable feature. 

The separate system on ESS also consists of 12 solid propellant 
motors installed prior to launch. The total cost of this system would be 
57.4 million dollars (20 stages). The major cost elements are the payload 
penalty resulting from orbiting the system weight of 9300 pounds (37. 2 
million) and the cost of the motors (14. 0 million). The solid motors would 
require environmental protection during boost and orbit. 

The shuttle orbiter was also considered for deorbit but was found to 
be unacceptable because the deorbit loads exceed the present orbiter docking 
interface load-carrying capability. An additional 11,000 pounds of orbiter 
propellant would also be required to deorbit the ESS. 
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Figure C-I. ESS Deorbit Sequence {Utilizing Shuttle Orb iter) 
C-3, C-4 
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APPENDIX D. RECOVERABLE AVIONICS TRADE STUDIES 

To establish, the feasibility and economic advantages of recovering 
avionics equipment, it was necessary to perform a variety of trade studies. 
This section contains results of these studies. 

ASTRIONICS RECOVERY ANALYSIS 

The first study conducted was to determine the economic advantages of 
recovering avionics equipment and to establish which avionics components 
could be recovered and still have all the objectives of the mission achieved. 
Tables D-l through D-4 and Figure D-l contain the factors considered and 
options and cost considerations used to establish the approach to be used in 
the recovery of avionics equipment. Study results indicate that it is most 
cost effective if all possible equipment is recovered and additional equipment 
provided to perform the functions required for vehicle deorbit. 

Table D-l. Avionics Recovery Analysis 

Considerations Must have a deorbit system 

Equipment for deorbit shall be FO/FS at liftoff 
Pitch and yaw deorbit errors: ±5 degrees- 
±7.5 percent of 550 fps 
Limited recovery time (24 hr life) 

Deorbit done with QMS AV, ACPS for initial altitude 


Recovery Options No recovery of avionics system 

Recover in part; leave part for deorbit 
Total recovery; build separate deorbit package 
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Table D-2. Deorbit Considerations 


Deorbit Considerations 

Option I 
No Recovery 

Leave: 

4 computers 
12 memory s 
9 rate packages 
3 IMU'b 

Option II 

Partial Recovery 

Leave: , 

4 computers 
12 memorys 
9 rate packages 

Option III 

Maximum Recovery 
Leave: 

9 rate packages 

(Need separate 
deorbit packages) 

Mission timeline impact 

No 

+ 

Yes - 

Yes - 

Software changes for recoverability 

No 

+ 

Yes - 

Yes - 

Development of recovery methods 

No 

+ 

Yes - 

Yes - 

Environmental affect on removed 





hardware 

No 

+ 

Yes - 

Yes - 

Added failure modes due to recovery 

No 

+ 

Yes - 

Yes - 

Added checkout requirements 

No 

+ 

Yes - 

Yes - 

Refurbishment costs 

No 

+ 

Yes - 

Yes - 

Cost of new hardware for deorbit 

No 

+ 

Yes - 

Yes - 

Cost for making hardware recoverable 

No 

+ 

Yes - 

Yes - 

Installation, packaging, and safing 





Shuttle support for deorbit 

No 

+ 

Yes - 

Yes - 

Basic hardware cost savings 

No (-) 

Yes (+) 

Yes (+) 
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Table D-3. Recoverable Hardware Costs 


b 

1 

LO 


Item 

Quantity 

Option II 
(Partial) 

Option III 

(Maximum Recovery) 

Recoverable Hardware 




IMU 

3 

$900K 

$ 900K 

Computer and memory sets 

3 


$1, 320K 

Value of recovered hardware 


$900K 

$2, 220K 

Refurbishment costs ( = 40 percent) 


$360K ' 

$ 888K 

Installation and checkout 


$150K 

387K 

Added deorbit hardware costs 



$ 600K 

Delta packaging costs 


$240K 

300K 

Total savings 


$750K 

$2, 175K 
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Table D-4. Recoverable Avionics Conclusion 


a 

i 


No recovery: build 20 sets (»7.22M each) - $44. 4M 
Savings from recovery (Option III) 

Build five sets 

Installation and checkout (15 sets) 

.Refurbishment cost (15 sets) 

Delta packaging cost 
Deorbit kit (20 sets) 

$41. 8M [J> $2. 6M SAVED 


$11. 1M 
1. 6M 
11. 1M 
6. 0M 
12. 0M 


Saving does not include 

Software changes to adopt to recoverability 
Development of recovery techniques 
Mission timeline constraints 

Unknown effect of environment on removed avionics* 
Added failure modes for removal hardware 
Uses shuttle for attitude orientation for deorbit 








Figure D-l. Recoverable Avionics Cost Savings 
DEORBIT SUBSYSTEM CONFIGURATION . 

Before the baseline configuration of the deorbit was established, 
various configurations were considered. The following is a description of 
these alternatives and the rationale used to formulate the decision concerninj 
each configuration. 

Figure D-2 depicts the various approaches considered for the method 
of transmitting data to be implemented for the de orbit equipment. Table D-5 
depicts the various techniques considered for the implementation of a 
separate de orbit control capability. 

The considerations contained in Table D-5 and Figure D-2 ranged from 
using the existing data bus system with a degraded memory for the CPU to a 
separate deorbit package which interfaced with the ESS subsystems down- 
stream of the data bus. 

The separate hardwire deorbit package option was adopted as the 
baseline for the ESS. The deciding factors were centered around the fact 
that more positive inhibit techniques could be implemented with the hard- 
wire system. This method also provides for the maximum retrieval of 
avionic equipment. Another significant factor was that most of the com- 
ponents required for this subsystem could be considered as off the shelf 
from other programs. 
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Figure 0-2. Data Transmission Alternatives 
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